• A Django site. •
• •
June 20, 2009

Richard K. Miller
no nic
Richard K Miller
» Do We Need a New Internet?

The New York Times recently asked, Do We Need a New Internet?

…there is a growing belief among engineers and security experts that Internet security and privacy have become so maddeningly elusive that the only way to fix the problem is to start over.

A new Internet might have more security, less anonymity.

As a new and more secure network becomes widely adopted, the current Internet might end up as the bad neighborhood of cyberspace. You would enter at your own risk and keep an eye over your shoulder while you were there.

Stanford’s Clean Slate Project intends to “reinvent the Internet” to “overcome fundamental architectural limitations,” including security.

I’ve previously asked, Is the Internet broken? One place it might be broken is in the ability for parents to protect their children, and interested people to protect themselves, from pornography.

If the university most associated with the invention of our current Internet is willing to reexamine its underpinnings and reinvent it, more incremental changes like CP80 or Larry Lessig’s H2M seem worthy of consideration.

Of course, anonymity can be a virtue. Anonymity allows seekers to learn about a new religion in a low-pressure way or protestors in Iran to orchestrate protests.

The tech-savvy, often libertarian-leaning people you find at Slashdot.org tend to dismiss proposals like CP80, considering them antithetical to the nature of the Internet. I like that one Slashdot user offered a thoughtful counterproposal: “The people who want a ‘cleaned kid friendly Internet’ can establish an alternate port where such a thing would be delivered….” (read more)

I think Bill Cosby’s adage applies: “I brought you in this world, and I can take you out.” We built the Internet. If it’s not suiting us well, we can change it. I think the Internet has already been a great tool for good, and will continue to be, but I don’t mind considering proposals that might improve it.

by Richard K Miller at 9:14 PM under cp80 , h2m , internet , iran , larry_lessig , law , lessig , main , pornography , privacy , speech (Comments)
June 18, 2009

Christer Edwards
nonic
Ubuntu Tutorials : Dapper - Hardy - Intrepid - Jaunty
» Create Anonymous Squid Proxy For Iranian Election Protestors

As I’m sure is the case with the rest of you (particularly if you use Twitter), I’ve been hearing more and more about the Iranian Election and the difficulties the people there are having in getting connectivity outside of the country. Without getting too detailed, it sounds like the incumbent president has cut off internet access to most major social networking sites. Sites that the protestors were trying to use to organize peaceful rallies and request recounts on the polls.

If you are interested in helping them fight to have their voices heard you can setup a Squid Proxy which will allow them to anonymously access Facebook, Twitter, YouTube and other such sites in order to organize and move forward. I have already personally setup and volunteered two proxies. The more that are available the better chance these people will have to continue to communicate with the outside world. If you would like to help out, please keep reading for instructions on how to setup a proxy and securely communicate the details to supporters inside Iran.

Note: please only configure and volunteer proxies for servers and internet connections that you own. Please do not run these on corporate or educational internet connections unless you have express permission.

Installing Squid

By following these instructions you should be able to have a Squid proxy available for use within just a few minutes. Even if you have setup Squid in the past, please make note of these customized instructions. The include access control restrictions to disallow Iranian government offices, and have logging disabled for anonymity.

To install squid use the command (or click on the link):

sudo aptitude install squid

Finding Your Public IP Address

You will need to document your public IP address for the configuration and for use by the protestors. You can find your public IP address by visiting the site: http://whatismyip.com. Make note of the address as you will need it for the configuration below.

Configuring Squid

We’ll now customize three things within the squid configuration.

  1. Select a random port other than the default of 3128
  2. Define access control list to allow Iranian subnets
  3. Disable logging for anonymity of Iranian users

Open your squid configuration file, which is found in /etc/squid/squid.conf and search for the line “http_port 3128″. Change the port number to a different, random port. Do not use the following port numbers: 81/8080/8181/9090/3218. These are globally blocked within the country.

Next we’ll define the access control restrictions. What this will do is allow proxy access to the Iranian residential address ranges but not include the government offices. It will also block all other use of your proxy.

Search for the line beginning with “# INSERT YOUR OWN RULE(S)” and add the following on the next blank line:

acl TRUSTED src 62.60.128.0/17 62.193.0.0/19 62.220.96.0/19 77.36.128.0/17 77.77.64.0/18 77.104.64.0/18 77.237.64.0/19 77.237.160.0/19 77.245.224.0/20 78.38.0.0/15 78.109.192.0/20 78.110.112.0/20 78.111.0.0/20 78.154.32.0/19 78.157.32.0/19 78.158.160.0/19 79.127.0.0/17 79.132.192.0/19 79.170.144.0/21 79.175.128.0/18 80.66.176.0/20 80.69.240.0/20 80.71.112.0/20 80.75.0.0/20 80.191.0.0/16 80.242.0.0/20 80.253.128.0/20 80.253.144.0/20 81.12.0.0/17 81.28.32.0/20 81.28.48.0/20 81.31.160.0/20 81.31.176.0/20 81.90.144.0/20 81.91.128.0/20 81.91.144.0/20 82.99.192.0/18 82.115.0.0/19 83.147.192.0/18 84.47.192.0/18 84.241.0.0/18 85.9.64.0/18 85.15.0.0/18 85.133.128.0/17 85.185.0.0/16 85.198.0.0/18 86.109.32.0/19 87.107.0.0/16 87.247.160.0/19 87.248.128.0/19 89.144.128.0/18 89.165.0.0/17 89.221.80.0/20 89.235.64.0/18 91.98.0.0/15 91.184.64.0/19 91.186.192.0/19 91.206.122.0/23 91.208.165.0/24 91.209.242.0/24 91.212.16.0/24 91.212.19.0/24 91.212.252.0/24 92.42.48.0/21 92.50.0.0/18 92.61.176.0/20 92.62.176.0/20 92.242.192.0/19 93.110.0.0/16 93.190.24.0/21 94.74.128.0/18 94.101.128.0/20 94.101.176.0/20 94.101.240.0/20 94.139.160.0/19 94.182.0.0/15 94.184.0.0/17 94.232.168.0/21 94.241.128.0/18 95.38.0.0/16 95.80.128.0/18 95.81.64.0/18 95.82.0.0/18 95.82.64.0/18 95.130.56.0/21 95.130.240.0/21 188.34.0.0/16 188.93.64.0/21 188.121.96.0/19 188.121.128.0/19 188.136.128.0/17 188.158.0.0/15 193.189.122.0/23 194.225.0.0/16 195.146.32.0/19 212.16.64.0/19 212.33.192.0/19 212.50.224.0/19 212.80.0.0/19 212.95.128.0/19 212.120.192.0/19 213.176.0.0/19 213.176.32.0/19 213.176.64.0/18 213.195.0.0/18 213.207.192.0/18 213.217.32.0/19 213.233.160.0/19 217.11.16.0/20 217.24.144.0/20 217.25.48.0/20 217.64.144.0/20 217.66.192.0/20 217.66.208.0/20 217.146.208.0/20 217.172.96.0/19 217.174.16.0/20 217.218.0.0/15

http_access allow TRUSTED
http_access deny all

access_log none
cache_store_log none

visible_hostname <your public IP>

Once you have saved these changes run the following two commands to activate things:

sudo squid -z
sudo /etc/init.d/squid start

If you don’t see any errors you should be ready to go. You can now submit your public IP address and random port to the following email addresses for secure propagation within Iran.

me@austinheap.com and smallworldnews@gmail.com

I hope you are able to volunteer toward this cause. The stories that I have read and the videos and images I have seen show a real injustice is going on in that country. There are many young people who are trying to vote in a real Democratic election, yet their votes are being ignored and their voices are being silenced. If you believe that Freedom is something we all deserve, get involved.

You can find more information and inside updates here here and here.

Other Points of Interest

by Christer Edwards at 11:25 PM under anonymous , community , election , internet , iran , privacy , proxy , squid (Comments)
May 6, 2009

Phil Windley
pjw
Phil Windley's Technometria
» Contrasting Kynetx and Greasemonkey

Kynetx Logo

Kynetx Network Service, or KNS, modifies a user's Web page using Javascript. The ability to customize pages in the browser is a powerful capability, but it goes well beyond that by allowing data from multiple sources, even other Web pages, to be used as part of that customization. Sure we can change change colors, fonts, and layout, but we can also mashup Web sites to produce completely new experiences.

Described as I have, KNS is not unlike Greasemonkey, a popular plug-in for Firefox that allows user scripts to modify Web pages. In fact, in a recent post Paul Madsen discussed the KNS/Greasemonkey connection. Consequently, I thought a comparison of KNS and Greasemonkey would be in order. Note that I'm not a Greasemonkey expert, but I happen to be the world's foremost authority on KNS. :-)

Like the Web, KNS is a hybrid cloud and client solution. Greasemonkey is a client only solution, although it can, of course, reference data in the cloud. This has a number of positive consequences:

  • Like any good cloud-based application, Kynetx apps are available and work consistently on any machine you use.
  • Referenced data sources can be easily cached and proxied. This offers opportunities to increase performance and ease of use.
  • Updates happen automatically as the servers are updated, like any cloud service. For example, recently Google started experimenting with AJAX search result pages which required updating scripts that augment Google. We changed some things on the server and users saw the updates immediately.
  • Increased security. As an example, a malicious KNS app can be disabled on the server saving all users from the effects.
  • Auditing and analytics are possible. Kynetx can audit apps for suspicious patterns and provide easy-to-understand reports about app privacy and security policies and activities. Server-side analytics give developers usage data on their cards without compromising individual privacy.
  • We can track when the actions (ruleset) associated with a particular card change and warn the user.

KNS is controlled by a domain-specific language: KRL (Kynetx Rule Language). Greasemonkey uses raw Javascript.

  • KRL provides developers with an easy way to create apps that work across browsers and operating systems. All of the details about working in Firefox or IE are abstracted away.
  • KRL provides developers with a powerful lever for quickly developing apps. Augmenting search result pages, for example, is a simple action that replaces dozens of lines of Javascript.
  • The abstractions of KRL allow Kynetx to respond to changes in browsers, Javascript, and Web sites with updated interpreters or runtime libraries to address the changes without developers having to change their apps.
  • People who would never develop Javascript programs have successfully developed Kynetx apps.
  • When the going gets tough, like any good domain specific language, KRL let's you jump out into raw Javascript to make up for holes in the language. As this happens, we'll incorporate commonly used patterns into KRL, making it more powerful.

KNS is based on Information Cards. Greasemonkey scripts are not associated with any particular identity system. We call Kynetx action cards "KIX".

  • Information cards are tied to a specific action. Because of the security model of information cards, the KRL ruleset associated with a particular card cannot be changed. Thus, when a user gets a KIX, they can be assured that the actions associated with it are the ones the developer intended and haven't been replaced by a malicious program.
  • The converse of the last point is that if someone creates a malicious app, it has a specific identity that cannot be hidden or changed. KIX can be rated, reviewed, and analyzed based on a non-mutable identifier.
  • The information card selector provide a nice user interface for installing, controlling, managing, and deleting KIX and their associated actions.
  • While KIX do not yet support in-card claims (personally identifying data), when they do, access to that data will be via the well-thought out and "socially tested" information card ceremony putting users squarely in control and mindful of what personal data they're releasing to make a Kynetx app work.

For the moment, KNS is simply placing tags on pages ('ala Greasemonkey 0.3) rather than executing scripts in a sandbox ('ala Greasemonkey 0.5). The later model is clearly superior from a security standpoint and would also give KNS performance advantages over it's current execution model. That's where we're headed. Still, because of mitigating design in our architecture, the current risk is small: we do not allow tags to be inserted on wildcard domains. This allows developers control on which domains tags are placed and thus protect user privacy and security.

Web augmentation is a fascinating place to be building technology because there are so many interesting problems to solve. Our goal for the KNS model for augmenting Web sites is to create a system that is general, safe, performant, easy to use, and easy to develop for. We're very close to opening up the doors for developers to start using KNS to create augmented Web experiences of their own. Stand by!

Tags: kynetx code krl kns security privacy

10:53 PM under code , kns , krl , kynetx , privacy , security
September 3, 2008

Richard K. Miller
no nic
Richard K Miller
» How to browse securely with SSH and a SOCKS proxy

I was in Moab this weekend with my family and our motel had free wireless Internet. I used SSH and a SOCKS proxy to create a secure tunnel to my iMac at work. This allowed me to browse Gmail and Facebook securely.

Here’s a screencast on how to create an SSH tunnel and browse securely in Safari and Firefox:

Here’s a full-size video:
How to browse securely with SSH and a SOCKS proxy (full size video)

These are the basic steps on a Mac:
1. Open Terminal. (In your Applications/Utilities folder.)
2. Type “ssh -D 9999 username@example.com”, replacing “username” and “example.com” with the actual username and address of your remote machine. The remote machine will need the SSH service, or Remote Login service, turned on.
3. Open System Preferences -> Network -> Advanced tab -> Proxies.
4. Turn on the “SOCKS Proxy” and enter “127.0.0.1″ and “9999″ in the fields. Click OK and Apply.

Now your Internet connection will be tunneled through a secure connection to your remote machine — a poor man’s VPN.

by Richard K Miller at 4:54 PM under mac , main , privacy , security , tech , unix (Comments)
August 26, 2008

Phil Windley
pjw
Phil Windley's Technometria
» P3P and Internet Explorer

If your Web service does anything that sets cookies, you'll probably bump up against the fact that Internet Explorer--since version 6--has implemented a fairly strict privacy policy regarding cookies. In a nutshell, if the site does not have the right P3P privacy policy, first-party cookies (i.e. from the site itself) are downgraded to session cookies and not stored in between browser sessions and third party cookies (i.e. from another site) are rejected completely. Here's what to do to solve this problem.

P3P, or the Platform for Privacy Preferences is a W3C "protocol allowing websites to declare their intended use of information they collect about browsing users." In IE 6 and 7, users can use a slider bar to set their desired degree of privacy and then IE will automatically check the privacy policy of the sites they visit and "protect" them according to their preferences. The default setting (medium-high, which most people never change) gives the behavior I describe above.

Deploying a P3P policy actually isn't very hard. There are some great tools for creating the policy itself. But it can be difficult to know exactly what to do. I followed these instructions but still have a few questions, so I'll document exactly what I did below.

The first step is to create the policy. I used IBM's P3P policy editor. It's a Java program, so it will run most anywhere. Using the tool takes a little work since it's not clear at first what you're editing. Create your policy from a template if you can since that will save a lot of decisions later. Once you've done that, select Policy->Policy Properties and fill in the information about your service and organization. If you look at the errors, you see that you have to fill just about everything in. Make sure you add a "privacy seal" even if it's just a notice that your customer service department can answer questions.

The policy itself is in the "groups" on the right. Double click each one and make sure you agree with what it says. Clicking on "Errors" will show you things left undone and clicking on "HTML Policy" will show you the human readable version of what you're creating. At the bottom it provides an analysis of how this policy will play in IE. Very helpful.

When you're done and there are no errors, you need to save four things:

  1. The policy itself as name.xml where name is the name you selected under "Web Sites" in the Policy Properties pane. You will likely have just one, but you can have many covering different parts of your site.
  2. A policy reference file as p3p.xml. This file provides discovery services for the policies. Whether you have one or many policies for your site, this file tells programs which policy applies where and how to find them
  3. A human readable policy
  4. A compact policy. This is a string of three and four letter acronyms that specify the policy in a compact manner.

Put the first two in http://yoursite.com/w3c/... Put the third in whatever URL you specified the human readable policy would be referenced by.

The compact policy is used in the HTTP headers that your server returns for ant HTTP request. This gets rid of one or more round trips to the server to request the XML version of the policy. In my experience, this was a necessary step to get IE to recognize the policy.

Having Apache return the compact policy in the header requires building and installing the mod_header module. I'd already done that so I simply added this line to my HTTP configuration file: 

Header append P3P "CP=\"NOI DSP ADMo DEVo TAIo ... DEM STA\""

Once you've got all this installed, you should be able to open IE, double click on the eyeball with the red slash through it in the status bar and confirm that your cookies are no longer blocked. If there are no blocked cookies, the eyeball is not there at all.

That's it from a technology standpoint. The trickier part is deciding whether you can actually live with the restrictions you'll need to put in place to let IE store your cookies.

The whole thing feels like a waste of time. Your product won't be better and most people won't be any more protected when your done. But you need to do it in an IE world.

Tags: kynetx privacy internet+explorer

9:14 PM under internet+explorer , kynetx , privacy
July 8, 2008

Jordan Gunderson
jordy
Jordy Blog
» FISA Vote Tomorrow

One of my friends sent me the following email:

Tomorrow, our Senate will vote on H.R. 6304, the FISA Amendments Act of 2008, which the House of Representatives recently approved. You can read Ron Paul’s observations about this bill here. Please urge Senators Hatch and Bennett to vote against it…

If our “limited government” Republican leadership passes this, they deserve to get kicked out of office.  That said, I shutter to think of the alternative.

Have you contacted your senators yet?

by Jordy at 8:49 PM under bob bennett , domestic espionage , ex post facto , fisa , grassroots , immunity , limited government , orrin hatch , phone tapping , politics , privacy , ron paul (Comments)
June 13, 2008

Christer Edwards
nonic
Ubuntu Tutorials : Dapper - Hardy - Intrepid - Jaunty
» Use VNC? Encrypt It Via SSH

I covered VNC this afternoon in my Linux system administration course and the question came up on how to secure VNC. You may or may not be aware than VNC is not encrypted by default, which could be a security concern.

If you use VNC regularly to connect to other Linux machines you may want to consider adding a level of encryption with SSH. Here is a quick run-down on how that is done:

If you look at the man page for vncviewer (man vncviewer) you’ll notice there is a small section for -via. The -via option, as outlined in the man page will do:

Makes the connection go through SSH to a gateway host. The gateway should be the target host for best connection secrecy.

Basically this is saying that you can tunnel VNC over SSH within your connection command. Let’s give it a try.

vncviewer -via user@host localhost:0

This, of course, will require that you have both ssh and vnc access to a remote machine.

This is a much simpler method than many other tutorials I’ve found which generally suggest creating a tunnel with ssh -L and then using that tunnel.

Related

by Christer Edwards at 4:04 AM under encryption , privacy , security , .ssh , vnc (Comments)
March 29, 2008

Phil Windley
pjw
Phil Windley's Technometria
» Dan Solove on Reputation

Clifford Thomson sent me a link to a talk Dan Solove gave at Google on his new book The Future of Reputation. I interviewed Dan on Technometria a while back about his earlier book The Digital Person.

Dan's a very interesting speaker and raises important issues in his books and in this video. This is well worth watching if you're interested in the intersection of privacy and reputation in the Internet age.

Tags: itconversations reputation identity video privacy

5:51 PM under identity , itconversations , privacy , reputation , video
November 28, 2007

Phil Windley
pjw
Phil Windley's Technometria
» Facebook Beacon Demo

If you've been curious about privacy concerns over Facebook Beacon, this demo shows how it works and why some are concerned. I think Moveon.org is totally the wrong organization to take this on, but whatever.

If you're a Firefox user (one more good reason to switch), these instructions show how to use the BlockSite plugin to kill Beacon. This will still allow you to use the rest of Facebook.

Tags: facebook social+networking privacy

5:32 PM under facebook , privacy , social+networking
November 26, 2007

Phil Windley
pjw
Phil Windley's Technometria
» Stop Complaining and Starting Building

Doc, as usual, hits the nail on the head in explaining how to solve the privacy-problem-de-juer: Facebook's advertising platform. To wit:

If we want our reach to truly exceed Facebook's grasp, we can't just tell Facebook to stop grasping. We have do deals on our terms and not just theirs. We have to have real relationships and not just systems on the sell side built only to "manage" us, mostly by minimizing human contact.

Perhaps most of all, we need to come up with systems that help demand find supply, rather than just ones that help supply find (or "create") demand. That means we need alternatives to the outmoded and inefficient system of guesswork we call advertising.

That doesn't mean we make advertising go away. But it does mean that we find new paths between demand and supply. and it does mean that find ways to get unwanted advertising out of our face.

From Doc Searls Weblog · Making Rules, II
Referenced Mon Nov 26 2007 08:33:20 GMT-0700 (MST)

As I say in my piece at Between the Lines, I think there's more money and greater customer satisfaction in recommendations, but Facebook didn't go there.

Doc isn't, I'd guess, eschewing a commercial venture that would build these tools. Probably multiple commercial ventures. This doesn't have to be an open source project--although that's a possibility as well. People have made money--lots of it--connecting demand and supply for thousands of years. We don't have to imagine the alternative to demand generation as a revolution. Indeed, as Doc points out, it's a return to the long time order of things.

Tags: facebook privacy markets advertising

3:40 PM under advertising , facebook , markets , privacy
December 19, 2006

Lamont Peterson
Peregrine
Peregrine
» Marketing a Room Bug

Believe it or not, there’s a company (immi) that is giving away “special” cell phones with free service. The catch? The phone is also a room bug:

The IMMI phone randomly samples 10 seconds of room audio every 30 seconds. These samples are reduced to digital signatures, which are uploaded continuously to the IMMI servers.

But why would they do that? Money, of course:

IMMI also tracks all local media outlets actively broadcasting in any given designated media area (DMA). To identify media, IMMI compares the uploaded audio signatures computed by the phones with audio signatures computed on the IMMI servers monitoring TV and radio broadcasts. IMMI also maintains client-provided content files, such as commercials, promos, movies, and songs.

By matching the signatures, IMMI couples media broadcasts with the individuals who are exposed to them. The process takes just a few seconds.

Panel Members may sometimes delay watching or listening to a program by using satellite radio, DVRs, VCRs, or TiVo. IMMI captures these viewings with a “look-back” feature that recognizes when a Panel Member is exposed to a program outside of its normal broadcast hour, and then goes back in time (roughly two weeks) to identify it.

Now, let’s think about this just a little. If anyone in a given room has bought into this free cell phone scam (yeah, that’s right, I’m calling it a scam; you gotta problem wit dat?), then they have chosen to give up their privacy. But what they probably don’t realize or think about is that everyone else in any room they are in has just lost his/her privacy and they don’t know it.

Personally, I want to know what these “special” cell phones look like so I can recognize them. When I see one, I’m going to politely ask the “owner” of it to remove the battery. I’m sure they’ll look at me funny, but I’ll calmly, patiently and very briefly explain why. If they refuse, then I will ask them to leave the room or bury the phone in a purse, briefcase, coat or computer bag where it can’t hear anything.

I wonder what will happen when the first lawsuit is filed against the company for breaching other people’s privacy. I mean, since I haven’t signed their agreement, they are violating my privacy by placing the device with an irresponsible person who would allow it to be in the same room as me.

by Peregrine at 5:03 PM under privacy (Comments)
December 12, 2006

Lamont Peterson
Peregrine
Peregrine
» Jogger’s Accessories Make You Trackable

Researchers at the University of Washington have demonstrated a frighteningly easy way to track anyone who uses the Nike+IPod Sports Kit

One of them built the tracker hardware (for only $250) which they interfaced with Google Maps.

Their paper has the details.

This is a great example of how even without any personal information stored on an RFID chip, privacy is easily violated (as long it has anything unique on it, like an ID).

by Peregrine at 11:53 PM under privacy (Comments)
November 29, 2006

Lamont Peterson
Peregrine
Peregrine
» No Shirt, No Shoes, No ID, No Service

A man in Quincy, Massachusetts was refused service at the local IHOP restaurant when he refused to turn over his driver’s license before being seated.

Hilarious.

But there’s a great security point here, too. They wanted to reduce the incidence of “dine-n-dash” events, where people skip out without paying. Holding your driver’s license would surely help, or so they thought. But they didn’t count on the reaction to this violation of privacy or, more importantly, the inconvenience this was to their customers.

Security Rule #1: Security is only as good as the weakest link.
Security Rule #2: You’re weakest link will (almost) always be the users.
Security Rule #3: To users, security = inconvenience.

Observation of End Users in the Wild: Users will fight inconvenience.

Good security is invisible to users, or at least, it isn’t overtly present and doesn’t require them to do anything. That’s why supermarkets and convenience stores place monitors where customers can see that the front doors (and other high-value areas) are being watched. People make the assumption that the camera feeds are also being recorded (which is not always true, but often).

At least this IHOP incident wasn’t condoned by corporate management.

by Peregrine at 8:28 PM under privacy , security (Comments)
November 23, 2006

Lamont Peterson
Peregrine
Peregrine
» Podcast with Bruce About RFID Passports

If you care about security issues and/or your privacy at all, you should be concerned about the deployments (and pending deployments) of passports with passports with RFID chips embedded in them.

Bruce Schneier, CTO of BT Counterpane, author and world-renowned security expert & privacy advocate gave an interview regarding RFID passports. It is available as a podcast.

There isn’t any new information in there, at least, nothing that I haven’t talked about before. However, it is an excellent, easy to understand explanation of the key issues surrounding RFID chips being embedded in government issued IDs. It’s not very long, but is good information for everyone from the technically challenged to government officials and even security experts.

by Peregrine at 10:40 PM under privacy , security (Comments)
November 9, 2006

Lamont Peterson
Peregrine
Peregrine
» FIDIS on RFID Passports

The “Budapest Declaration on Machine Readable Travel Documents” is an interesting and informative read:

Abstract:

By failing to implement an appropriate security architecture, European governments have effectively forced citizens to adopt new international Machine Readable Travel Documents which dramatically decrease their security and privacy and increases risk of identity theft. Simply put, the current implementation of the European passport utilises technologies and standards that are poorly conceived for its purpose. In this declaration, researchers on Identity and Identity Management (supported by a unanimous move in the September 2006 Budapest meeting of the FIDIS “Future of Identity in the Information Society” Network of Excellence[1]) summarise findings from an analysis of MRTDs and recommend corrective measures which need to be adopted by stakeholders in governments and industry to ameliorate outstanding issues.

Thanks to Bruce Schneier for posting this on his blog.

by Peregrine at 8:17 PM under privacy , security (Comments)
September 15, 2006

Lamont Peterson
Peregrine
Peregrine
» TrackMeNot

A few days ago, Peter Abilla published a post about TrackMeNot.

I had read about TrackMeNot a little more than a week before on Bruce Schneier’s blog, and so I already knew TrackMeNot was a flawed idea. Peter also makes some very good points in his post, but, unfortunately, it falls short of pointing out some of the more serious problems with TrackMeNot.

I’ll just summarize the problems here. For further explanation, read Bruce’s post:

  1. It does not hide your searches (they are still identifiable with you).
  2. It’s far too easy to spot (and therefore, far too easy for AOL and others to defeat) and it’s schedule is regular & fixed.
  3. Some of the generated searches are worse than what you would try to hide.
  4. It wastes lots of bandwidth, while returning absolutely no privacy or security benefit.

I like this quote from Bruce’s post:

Yes, data mining is a signal-to-noise problem. But artificial noise like this isn’t going to help much.

by Peregrine at 9:37 PM under internet , privacy , security (Comments)
September 7, 2006

Lamont Peterson
Peregrine
Peregrine
» Quickest Microsoft Patch Ever

I just read this story by Bruce Schneier on Wired.

You really should read the whole article,even though I summarize it here.

The folks at FairUse4WM cracked Microsoft’s PlaysForSure DRM software in Microsoft Windows Media Player.

If you really want to see Microsoft scramble to patch a hole in its software, don’t look to vulnerabilities that impact countless Internet Explorer users or give intruders control of thousands of Windows machines. Just crack Redmond’s DRM.

It only took a couple of days for the FairUse4WM people to compensate. I’m sure it won’t be long before Microsoft tries to patch this again.

But the real moral of the story is that companies like Microsoft don’t actually care about security except when it embarrass them or directly threatens their strategic agreements (like with record labels).

by Peregrine at 5:51 PM under privacy , security (Comments)
September 1, 2006

Lamont Peterson
Peregrine
Peregrine
» New Anonymous Browser is Unsafe

You might have heard of the new Browzar web browser. Their website claims: “With Browzar you can search and surf the web without leaving any visible trace on the computer you are using.”

Well, it’s just not true.

It’s only a thin wrapper around Microsoft’s Internet Explorer version 5.5 (or later). Since IE stores all sorts of stuff in places on your system without telling you, Browzar can’t deal with all of it. Scott Hanselman has actually shown that Browzar misses the mark on this point.

There are other problems with this, too. For example, this program will not affect any servers that you visit, or any caching proxy servers in between (like at work or a university).

Anonymity on the web is not just about the stuff that’s on your computer, though it’s an important part; it’s also about the things those servers you connect to keep track of and tell each other.

Web browsers such as KDE’s Konqueror, Mozilla’s Firefox, Apple’s Safari (built on/from Konqueror, BTW) and others already support local privacy features. These include Konqueror’s excellent cookie management capabilities and Firefox’s support for auto deletion of cached data. All of these browsers sport these privacy enhancing features, though they have differing approaches and levels of control.

by Peregrine at 6:30 PM under internet , privacy (Comments)
August 31, 2006

Lamont Peterson
Peregrine
Peregrine
» Blog SPAM as Phishing Bait

Today, I decided to take a look at a couple of the links that blog spammers have been trying to put up in my blogs’ comments. Most of it actually led to “anti-spam” websites that are actually spam list phishers. This is, of course, very clever of the spammers.

First, they put spam up that includes links to their phishing sites on blogs they troll the net for. This part is very easy, thanks to services like Technorati and Blogger.

Next, “young” bloggers (i.e., those who are still fairly new to the “sport” of blogging), see comments. Either they naively authorize the spam comment, don’t moderate at all or decide to follow the links and check it out before authorizing the comment. If the comment gets posted to the blog, then others who read the blog can fall into the trap. If the blogger decides to visit the pages, they could get sucked in to all kinds of things.

But as I looked at a few of the links, they turned out to cause redirects to either www.abusepost.com or www.spamcop.net (I didn’t make those into links on purpose; DISCLAIMER: GO TO THOSE SITES AT YOUR OWN RISK, I’M NOT RESPONSIBLE FOR YOUR CHOICES). Of course, the vast majority of bloggers, both experienced and just getting started might think that those sites are providing a pretty good service. Looking a little more closely at the form and at the HTML itself reveals that these sites look suspicious. They require your name, email address and website address (which will be the blog that they hooked you at in the first place, for most people).

Were you paying close attention? They require you to provide the exact information spammers want in order to “report” a site that they are already “about to shut down”? Doesn’t make much sense to me.

Do you smell phish or am I the only one?

A word to the wise: Just Say No.

Here are some simple rules for Internet safety, though, they apply (with proper contextual edits) to any online communication:

  1. Moderate — Whether it’s comments on your blog(s), forums (which I hate, BTW) or mailing lists. Moderation is currently the most consistently effective way to defeat all forms of SPAM.
  2. Never give out your information if you don’t have to — Just because a particular website’s “form” says that it requires your information, doesn’t mean they should be given any. We all know not to publish our credit card numbers online, but it’s amazing how many people don’t understand that your name, email address, street address, phone numbers, websites, employer’s name, favorite color, mother’s maiden name, etc. are not needed by most websites. When in doubt, don’t give it out.
  3. The only stupid questions are the ones you do not ask — In other words, ask someone you know who has lots of experience with the Internet, email, spam, security, etc., any questions about specific websites or other items in general. Keeping yourself safe is hard enough to do, but keep trying to do it without the right information and you just might make things much worse.
  4. Don’t open HTML emails — If someone sends me an HTML email (and I think it’s worth this effort), I send it back to them with a simple, polite note explaining that for security reasons, I do not accept nor read emails that are not in plain text. Too many people are using stupid email programs like Microsoft Outlook and Outlook Express that have hundreds of severe security flaws when it comes to processing HTML email, alone.
  5. Don’t Panic — It can be easy to let fear take over at this point and abandon your dreams of blogging and the “Internet lifestyle”. Don’t worry, it’s not that hard to keep yourself safe. Once you know how to recognize the dangers, it’s easy to avoid them.
  6. Think — (OK, this one could sound kinda mean, but it’s not; it’s just a sad truth, so don’t take it too personally) The spammers and the Phishers keep doing what they do because it works. There are just too many people on the Internet who do not think for themselves. You have a brain and I’m sure it functions at least well enough to read this far. I’m sure you have a lot more capacity to figure things out than you might be giving yourself credit for. Being able to think is not enough on it’s own, but with a little bit of knowledge, your brain can be used to help keep yourself, and your loved ones, safe on the Internet.
  7. If in doubt, bail out — You don’t have to go any further than you already have when visiting any website or continuing a discussion on IM in a chat room or on a mailing list. You can pull the rip-cord at any time.

I’m sure there are other things that we could put in that list. Perhaps some commenters will try to help me out in that regard. But I think these basics should be enough to get you started.

This is one of my favorite Turkish proverbs:

No matter how far you have gone down the wrong road, turn back.

by Peregrine at 1:28 AM under internet , privacy , security (Comments)
August 28, 2006

Lamont Peterson
Peregrine
Peregrine
» More Security by Overreaction

Wow. This story even includes a WoW reference. Yet another example of security by overreaction.

Although I’m not a lawyer in Canada or anywhere else, but it sure feels like this guys rights were ignored. It is especially disturbing to me that his notebook was riffled after he was already cleared; after the authorities decided that it was a complete false alarm.

I also think that it’s both good and bad that these kinds of overreactions are being ignored by the mainstream media. It’s good because they’re not fearmongering as much as they did. It’s bad because they are not showing how the recent fearmongering is still affecting us and they are missing out on the civil rights/anti-privacy story. Then again, it would seem that the mainstream media doesn’t understand privacy. Perhaps it’s not in the “journalist’s Glossary”?

Thanks again go to Bruce Schneier for bringing this example to our attention.

by Peregrine at 8:35 PM under privacy , security (Comments)
June 23, 2006

Lamont Peterson
Peregrine
Peregrine
» AT&T Announces New Privacy Policy

In yet another interesting article in today’s issue of USA Today, I read about AT&T’s latest move regarding it’s privacy policy.

Oh, and the EFF gets mentioned in the article, starting from the second paragraph.

by Peregrine at 4:24 AM under privacy (Comments)
June 15, 2006

Lamont Peterson
Peregrine
Peregrine
» The Value of Privacy

I just read this great article by Bruce Schneier.

Privacy is a very important matter. Privacy is a central, core component to liberty and true freedom. If we (US Citizens) don’t pay attention to it, there are forces who would like to take it away. Most of the time, we call those forces terrorists, but there are other more subtle forces also at work in the world.

My good friend, Pete Ashdown has an exellent position on the issue of privacy, and I support him on these efforts.
(more…)

by Peregrine at 6:40 PM under politics , privacy , security (Comments)
November 1, 2007

Phil Windley
pjw
Phil Windley's Technometria
» ProQuo - Stopping Junk Mail

I just created an account at Proquo and spent 15 minutes stopping the insane amount of junk mail I get. Most of the "do not mail" lists you get on with a simple click and some require filling out a form off the site. The most obnoxious was the DMA, which charges a dollar "to cut down on fraud"--yeah, sure. Like I trust them. The credit card link, unfortunately, didn't work--I'd love to get Capital One out of my life. I'll see if in a few months the volume has significantly reduced and let you know.

Tags: identity privacy

4:50 AM under identity , privacy
September 12, 2007

Lamont Peterson
Peregrine
Peregrine
» sign-lots-o-keys

On the last day of the Utah Open Source Conference 2007 (UTOSC), there was a PGP/GPG key signing party, hosted by Scott Paul Robertson. It was good to be able to get set up to properly sign so many keys, but it did give me a little problem; I needed to sign everyones’ keys with each of my 4 active keys. That would have been over 100 times running the gpg command. Sounds like something begging to be scripted, so I did.

I’m posting the script, which is still very rough, as I didn’t both taking any time when I whipped it up last night to take care of everything that it really should be doing. Still, I’ll work on it here and there, I’m sure. You can download it from http://www.openbrainstem.net/download/sign-lots-o-keys. If you feel like makeing some fixes, either post your patches (please, create them as a unified diff file, if you wouldn’t mind) and put a link in the comments here and/or on your own blog.

Enjoy!

by Peregrine at 1:00 AM under internet , linux , privacy , security (Comments)
August 19, 2007

Lamont Peterson
Peregrine
Peregrine
» New U.S. Wiretapping Law

On August 5th, 2007, President Bush signed S.1927 into law, after it passed a Senate vote (60 for, 28 against, 12 present but not voting) on the 3rd, and a House vote (227 for, 183 against, 23 present but not voting).

The new law amends the “Foreign Intelligence Surveillance Act of 1978 to provide additional procedures for authorizing certain acquisitions of foreign intelligence information and for other purposes.” It was sponsored by Sen. Mitch McConnell [R-KY] and Sen. Christopher Bond [R-MO].

I haven’t had time, yet, to fully read the resulting text of the bill (there are always amendments to bills as they pass through Congress), so I will reserve any specific commentary for a latter time. However, it appears that this new law could seriously affect privacy under certain circumstances in the United States.

by Peregrine at 3:42 PM under politics , privacy (Comments)