Open Hatch

Archive for the ‘Digital Security’ Category

I’m home sick, surfing randomness on the internet when I’m not in bed coughing and reading THE HERO OF AGES. Almost done with that book. (Loving the series, and this third book in it, so far.) I’d link to it on the web, but guess-what? Your Internet is not spoiler-free. You can’t even count on the back-cover of this book to avoid spoilers relating to the first two. Read MISTBORN first. And that is very highly recommended.

Anyway, some of what I’m running across in said surfing.. Oh My Weirdness.

Below is the advertisement that introduced the world to the original Apple computer, in 1984.

This ad pays homage to the sci-fi novel 1984, and the film adaptation of it, in which Big Brother, mythical/quasi-real figurehead of the totalitarian state Oceania, is betimes represented on giant, uh.. telescreens. Obviously, this represents Apple shattering all that Big Brother.. whoever he is/was in real life.. embodies. Then, presumably IBM; later Microsoft.

(Other reading today: Google as Big Brother. Scroll down to the list. After a read-through, I think one must admit it is at least a bit scary, or else one must be declared, possibly, slightly careless. Maybe I don’t care. But I probably do. I am at least delighted and entertained, conceptually, by many of the things posted at google-watch.org.)

My take: anywhere that technology does things against your will, or affects you in ways you might not choose, without informing you, it’s Poorly Conceived technology, and is probably working in some ways Against You. Combine this with attempts by those who produce the technology to have the means of creating or delivering the technology entirely closed and proprietary, forever, insofar as they can assure.. and you have Technological Oligarchy.

This model still holds the day [citation needed], and perhaps it will, in its scope, forever.

I’m not really a fan of the model, but I think going toward an open-standards, open-source, free-everything approach can tend to an opposite extreme. I’m not sure where information-technology democracy is embodied or idealized, or even if it can or should be, and I’d offer snarky or ranting comments for or against this or that, uh, technological thingie, but mostly, I think.. I’m getting by.. I never really attended any of the screeds for or against this or that technology at this or that Hate Week in this or that Oligarchy. But if any of these pretentiously conceived technological oligarchies causes me duress, I may, uh.. let you know..

I was just fiddling with the search toolbar and searching from the address bar in Firefox. Somehow I ran into pages detailing how to alter the search behavior of the search bar in firefox so that it doesn’t automatically direct you to google’s “lucky” (#1 ranked) result of whatever you type. (I think that default behavior is presumptuous and annoying.) I also [update 11-10 blah blah blah blah I'm coming back to this and not even reading everything in my own entry, but here it is anyway:] show

Here’s how (copied from that page and updated with my instructions to set it to search via scroogle, with or without SSL). To do it without SSL:

1. At Firefox address bar, enter about:config and press ENTER.
2. At Filter: field, type keyword.url
3. You should see a Preference name of keyword.URL in the list. Double click it, a “Enter String Value” input box will appear.
4. Replace the string with:

http://www.scroogle.org/cgi-bin/nbbw.cgi/search?q=

If you want SSL (so that the search itself is impossibly obfuscated to any eavesdropping intermediary), just ad an s to http (https), so that this is the URL to enter in step four:

https://ssl.scroogle.org/cgi-bin/nbbwssl.cgi/search?q=

The real practical application of this may be limited, but it pleases my inner nerd

Modifying address bar behavior aside, I do think adding different search engines to the search toolbar is very practical. There are many varieties of information (and scenarios for their use) where the findings of a ranking algorithm are not ideal. To that end, here is a page that will lead you to any (or many) links you choose, which will add useful search engines to your search toolbar (not only to Firefox, but to unrelated browsers as well, I think!). And here is an associated (very cool!) Firefox add-onn that will add the search capability of any web site to your search toolbar; so that you can skip navigating to that site’s search tool, and just search from the toolbar.

Creepy oddness I just ran across: after a friend of mine on Facebook shared a link, their friend saw an advertisement on CNN.com that said so. “[So-and-so] shared [this-and-that] on facebook”, it said. This is probably only targeted to friends of that friend. Presumably, this is a service, or else why would CNN and Facebook be in kahutz to set this up without either user’s awareness or express permission?

How (technically) did it happen?

By default, Facebook allows all of the following information about you to be shared by your friends:

• Personal info (activities, interests, etc.)
• Status updates
• Online presence
• Website
• Family and relationship status
• Relationship details (significant other, looking for, etc.)
• Education and work
• My videos
• My links
• My notes
• My photos
• Photos and videos I’m tagged in
• About me
• My birthday
• My hometown
• My religious and political views

“Shared” means publicly available for harvesting by facebook applications, or now, apparently, facebook partner web sites (read on). If you’re logged into facebook, here is the link to the friends privacy settings page where you can uncheck all that.

That isn’t the only place with related settings, it seems. This page has a setting for whether “select partner” web sites (which evidently includes CNN) can “personalize your experience” by use of such information.

Even if you disable that, and you have a facebook account and have “added” any reasonable amount of people you know, the following is true: anyone can find your profile page, and from that page, they can learn all the following: your name, gender, “networks”, friend list, and Pages. This (minus a few things you can withhold, like a profile picture and your city) is all defined by Facebook as “publicly available information“.

All of this bothers me. About their “publicly available information” policy, I agree with this blogger – this search of his blog pulls up three posts about it at this writing. The report he links to from the EFF is alarming, and frankly damning. And I never thought I’d agree with the ACLU on any point

It seems to be the most common attitude of social media engineers; that there is no ethical problem in manipulating people into disclosing as much about themselves as possible, and making this information boundlessly and permanently available. They declaim: we respect your privacy. Rubbish! Their bottom line is advertising, and that means the more information about users they can harvest and exploit (with or without your knowledge and express consent), the better their bottom line. End of story – and all the evidence in the ongoing story supports it.

Google Buzz is also terrible with privacy. Here’s the revision as of this writing, of the Wikipedia entry’s section on privacy concerns over that service. Most notable and alarming there is the report that by using Buzz, a woman was found by her abusive ex-husband, because it shared her contact and work information without her knowledge or consent.

This page relates how to disable the service in gmail, or at the least curb what it discloses about you.

Other readings – a blogger who was creeped out by Buzz’ initial release – Google quoted as officially stating “there is no complete privacy” – a blog post that may be fairer to Google. Still, the release of Buzz was recklessly dismissive of (or even contemptuous toward) privacy concerns.

I’m kinda puzzled, though. The newest relevant blog article I can find on it (and here are two previous – 1 – 2) relates that Buzz hasn’t disabled default sharing of your “following” and “followed by” lists, but; in my own test of Google Buzz, after I joined, activated my profile, and logged out, I viewed my public profile link, and it didn’t display who I’m following and who I am being followed by. (I’ve suddenly just imagined a strange and tasteless modern retelling of Jesus’ arrest and mock trial, in which Peter is accused by those around him of following Jesus’ twitter account, and denies it thrice before, erm.. the google cache reveals it.. and Peter goes out and weeps bitterly.) It also said there wasn’t enough information to be indexed, so maybe that’s why. Regardless.. it’s well enough for me to be part of Google’s Brave New World via the search engine and gmail. Sigh – and YouTube.

I ran across this site, foursquare. That link is to an anonymous (to me) user who volunteers exactly when and where he is, at any and many times. Specific times and addresses, and all of this is completely public. It is creepy enough knowing the founder of Facebook makes breathless declarations about how (allegedly) outmoded privacy is, and how easily people could be burglarized as a result of tweeting about their vacation (or updating their status in any of a variety of social media).

WARNING: very foul culture exposed in the first link to follow – avoid if you’d rather not know.

[link 1 - link 2 - link 3.]

The article at the first of that group of links explains how easily you can locate any stranger’s house by connecting, as an example, geotags from a flikr account to an individual. But this foursquare service provides all that in one glance, in addition to time information in one glance, for anyone to look up. Any burglar (or worse) who wants to find a target doesn’t even need their name. Time and location is enough.

mindlesstweeter plane landed! did u see my tweets about my new expensive electronics? pls burglarize me!

goods4me @mindlesstweeter: in ur house raiding ur expensive electronics! u cannot find me my accnt is behind anonymus proxy hahaha

[Myeh. The Wordbook plugin copied the first draft with an innacuracy too soon at FaceBook, and I can't change it.]

I’ve become fascinated and very impressed by public-key encryption, which I’d never understood, but have now read up on at Wikipedia.

With this setup, you and you only hold a private decryption “key”. You also have a public encryption key. Anyone can encrypt anything with your public key, but anything so encrypted with your public key can only be decrypted with your private key. Your public key can therefore be completely public.
Read the rest of this entry »