Privacy « My Digital Identity

Archive for the ‘Privacy’ Category

Canadian Identity Theft Coverage

Wednesday, January 23rd, 2008

Identity theft got some more attention today with CBC coverage on reactions to their Going Going Gone segment.
Silentbanker windows trojan/key logger was mentioned as a threat without much in the way of protection being identified.
Jennifer Stoddart and Michael Geist were interviewed with the conclusion being that more teeth is needed for enforcing the need for confidentiality.
The american model requiring disclosure of security breaches was mentioned as a necessary step as well as Canada lagging G8 countries in anti-spam legislation.
Identity theft has been mentioned by the Harper government as a growing crime they will be targeting.

Posted in Identity Theft, Privacy | No Comments »

Let’s be clear about what are our secrets

Sunday, November 25th, 2007

There is a need for people, especially system developers, to have a clearer understanding about secrets both for identification and authentication. This also relates to privacy since our secrets must remain private but we may also want to keep information private that is not related to security.
Information used for identification doesn’t necessarily need to be secret but if it is used for authentication it is important that it is secret. Also a secret that a user shares with many different people, systems, and/or services isn’t a secret. Many password implementations don’t take into account the limited capability people have for maintaining secrets or even recognizing what they should keep secret. Even if the information isn’t used as a password often public information is used for password resets which isn’t very secure. The following article raises these issues with the example of birth date which shouldn’t be used as the sole piece of information to identify a person and never for authentication.

A good security system should leverage a small set of secrets that users clearly understand should not be made public and are not directly reused. An example of indirect reuse is to have a master password that creates a unique password that is generated with encryption software from some context specific information like the address of the web site.

Musing about openness and security:

A few days ago I read a report about the dangers of making one’s date of birth public on the web. “After all, unscrupulous people can make use of that data and commit some sort of electronic theft.”

And I thought to myself, what utter tosh. That’s about as meaningful as saying “Most car accidents take place within three miles of home, so don’t drive near home”. Or even “most murders are committed by people known by the victim, so it’s best not to know anyone”.

Currently there’s a lot of personal data freely available on the web, particularly with the advent of electronic social networks. And currently it is possible to misuse that data in order to commit some crime or the other.

So something has to be done. Agreed. But. Rather than make people “hide” personal information, surely the answer lies in making better security “devices”. Surely the answer lies in making a person’s date of birth (or for that matter a person’s mother’s maiden name) less “valuable”.

I don’t know, I must be growing old. Sometimes I look at what we do, and I think to myself: First we take living things and make abject skeletons out of them. Then we carefully build cupboards around the newly formed skeletons. And then we wonder why we have skeletons in cupboards.

We shouldn’t have to hide simple information about ourselves. We shouldn’t have to worry about the Semantic Web, and how people are going to misuse personal information for the most heinous of crimes. We shouldn’t have to worry about “our past catching up with ourselves”. We should not build systems that make use of simple easily-accessible information as security tokens and devices.

Of course we should teach people to be prudent about what information they make available on the web. But let’s not forget that the web has always been about openness and transparency. That this is a good thing.

For centuries people have been putting spare keys under mats and in plant pots and over door ledges. For centuries unscrupulous people have found the spare keys and put them to nefarious use. The answer to that problem was not to change the locks, but the unsafe practice. The right unsafe practice. In this particular instance, the unsafe practice is the use of dates of birth and stuff like that as security tokens.

Just musing.

Posted in Privacy, Secrets | No Comments »

Who Owns your PC?

Thursday, December 7th, 2006

This may seem to be obvious but when you really think about it the answer may not be so obvious.

You bought the personal computer and presumably installed the software that runs on it but are you really in control of what it is used for?

If your PC isn’t secured it can fall prey to malware that takes control of your computer and turns it into a zombie that is remotely controlled at least in part by some criminal. This takeover is sometimes referred to as the criminal owning your computer since they are making use of the asset you have purchased for their own purposes.

But you protest this is the exception to the rule – a special case that with proper precautions won’t happen to you.

However this question of ownership becomes murky even without a bad guy taking over your computer with some trickery.

What about software that has some hidden features to “phone” home and report information about you to the mothership? Sometimes this is advertised as a customization feature but is it a feature you control and have a choice about? If not, its human counterpart with these characteristics might be called a traitor or informant. Your computer is at least partly owned by the software supplier to do its bidding whether you like it or not. There are many examples of software companies who have been caught including these types of features. Their claims that this was just to provide better services seem suspicious without open disclosure. This is where software to catch and allow you to make a decision about software initiated outbound requests can be important.

A lot of decisions about the use of “your” computer resources like memory, disk space, and CPU cycles are often made on your behalf by the Operating System and other software. What seems to be missing is what in privacy circles is called informed consent. Granted it is a challenge to make computers simpler to use and not every computer user wants to tune their computer for optimum performance but have we gone too far in the direction of uncontrollable software defaults and not done enough to inform and empower the computer owner to control how it is used? Even with the tremendous advances in disk, memory, and CPU technology these still can be considered scarce resources that computer owners might not want to be used up by services that we aren’t aware of and probably don’t need.

Web sites do exist that provide information on operating system options can be turned off but at the present time this can be considered a black art to be done at your own risk without the support of the suppliers. What is needed is capabilities to allow owners to intelligently decide what they want to run on their computers and maybe even some artificial intelligence to allow them from a user perspective to provide input on desired performance tradeoffs between programs. Improved owner consent and control could have big benefits both on computer performance and security since systems could move more towards default off rather than default on.

A common example are software vendors that include features that reserve memory even when the software isn’t being used so it will load faster. Are computer owners informed about the tradeoffs of these features and the impact of this on their system? While operating systems generally include a task manager or activity monitor just how informative and useful are these capabilities for the average computer owner? Most don’t even identify the resource hogs with names that relate back to the software name an owner would recognize. Processes can be killed but owner beware about the consequences of trying to control how much of their computer is used by various nefarious unrecognized programs or program components.

Things get even more complicated where Digital Rights Management (DRM) is introduced since this software puts restrictions on computer use to benefit content suppliers and not necessarily to the benefit of computer owners and content purchasers. Do computer owners have sufficient options that there is competition on what restrictions are acceptable? Could this also be considered another example where an outside party is owning your computer for their purposes?

Trusted computing technology also has the capability to control what software can run on “your” computer. Will computer owners have informed consent on how these capabilities will be implemented to their benefit? Who will decide how these technologies will be used to control “your” computer?

Posted in DRM, Privacy, Systems | No Comments »