Facebook is just the distraction from the real threat

The “Facebook problem” is real and it’s bad.  Whatever else you get from this, I’m not trying to play down the impact and continuing risk of data custodians who betray our trust.

It’s just that in the greater scheme of things, account takeover is much more dangerous, much easier to implement, verified to be ubiquitous on the web today, and yet is almost completely unreported.  We should address this and the Facebook problem but if we can do only one it should be this one.  This post explains why, and how I’ve tried to address it over time.

[Read more…]

Open Letter to Chris Cox and Facebook

2015-02-14_13-58-05It was nice of Chris Cox to post an explanation of Facebook’s name policy and apologize to “the affected community of drag queens, drag kings, transgender, and extensive community of our friends, neighbors, and members of the LGBT community for the hardship that we’ve put you through in dealing with your Facebook accounts over the past few weeks.”

Except that the post doesn’t honestly explain Facebook’s name policy.  The real purpose of the policy is to force you to use a name on Facebook that can be matched to the name you use to make transactions – such as the one on your credit card – so they can correlate the ads you’ve been shown to purchases you make in the real world and charge the advertiser more money.  This is why in the old wording of the policy they asked for the same documents they match against – driver license, credit card, etc.

[Read more…]

Identity as a weapon

Writing about the recent phenomenon that is #Gamergate, Kirk Hamilton makes some interesting points about identity:

It makes sense that doxxing—sharing someone’s address and other personal information against their will—is one of the primary instruments wielded in this battle. Doxxers use identity as a weapon, and so much of this conflict is, at its core, about identity. There’s the stated claim that the gamer identity is under attack, and also the pervading sense that this “war” is less about journalistic ethics and more about the murk of entrenched identity politics. Video games have hugely informed our generation’s cultural identity, and so cultural criticism of games feels somehow personal, like we’re the ones being criticized. I get it. I do.

He’s describing a tectonic shift in gamer culture as gaming goes from being largely white, male and young, to being increasingly diverse of race, gender and age. The cultural realignment of broadly defined identity can be expected to set off aftershocks that ripple through adjacent populations and disciplines. In this case, there was an identity quake of about 6 on the Richter scale in the gamer subculture that is rippling through journalism, hardware manufacturing, marketing, law enforcement, and on down to individual people. Among the results is a much wider public perception of the danger one’s personal details represents when in the hands of people you don’t trust.

Gaming is a very geeky subculture. It is assumed by many that the Gamergaters would have no trouble getting anyone’s personal information. Another result then is a social laboratory environment in which we get to see how that assumption affects behavior. Certainly Felicia Day held this belief when she wrote:

I haven’t been able to stomach the risk of being afraid to get out of my car in my own driveway because I’ve expressed an opinion that someone on the internet didn’t agree with.

HOW SICK IS THAT?

I have allowed a handful of anonymous people censor me. They have forced me, out of fear, into seeing myself a potential victim.

And that makes me loathe not THEM, but MYSELF.

Within moments of posting this, someone tweeted Felicia’s address.

From its beginnings, the Internet was designed and built functionality first, with security and privacy a very distant second, if at all.  SSL was an afterthought.  DNSSEC was an afterthought.  The original Internet anticipated how functions would work, not how they could be exploited.

Then we built Internet commerce on that shaky foundation and following the same template.  There is a strong parallel between the architecture of the commercial web and toxic waste dumping of the late 20th century.  Both involved the externalization of costs extracted from a manufacturing process.  The manufacturing of things based on atoms resulted in escrowing those costs as time capsules of toxic waste that would become the problem of some future people in return for larger profits today.   In the case of bits, widespread failure to implement even basic security to protect personal data generates larger profits today but also creates a situation in which the incremental cost of retrofitting security into large established systems is cost prohibitive.  Since that personal data can be used as easily to harm people as to help them, large databases of personal information which lack adequate security are akin to undiscovered pools of toxic waste – cheaper to build today, someone else’s future problem if it is abused.

We are now in the stage where the toxicity of bad security is leaking into the digital groundwater.  Those regular reports of massive breaches on high-profile web sites are today’s digital version of yesterday’s cancer clusters.  They are the early warning signs that a Security Cleanup Superfund is needed.  Except that the maps we draw will have corporate names like Hannaford, Sony, Target and Lowe’s instead of geographic names like Love Canal and Lemon Lane.

We ramping up quickly to build the Internet of Things according to the same old template.  We hear about a new “smart” version of an ordinary device just about every day.  Just as rapidly we hear about these same devices being hacked, or that the security is so bad that no hacking is required.  Since the prevailing model is that the devices are modern Trojan Horses, built first as a portal to your most intimate data and second with the functionality for which you bought it, they represent simultaneously our greatest opportunity and our greatest threat on the network to date.

So when I write about false parallels between the worlds of atoms and bits, or the need to build privacy-protecting or privacy-enhancing architectures, I feel a sense of urgency.  I am very aware that the work underway at IIW, NSTIC, OIX and elsewhere in the Identity world potentially powers the world of tomorrow.  As Dave Birch says, identity is the new money.

But I’m also keenly aware that identity can be turned into a weapon.  I’m generally lonely in that view but the Gamergaters have demonstrated how effective even a small amount of identity information can be as a weapon.  People are taking notice.  If we embark to build Personal Clouds using the same template we’ve always used, if we assume that privacy and security are legal and policy rather than technical problems, if the individual does not have sovereign ownership of their personal data, then we might as well be honest about what it is we are building.  Research into personal data technologies without design goals of privacy, sovereignty and agency, and lacking state of the art security controls would be a digital Manhattan Project.  The commercially successful implementation of such a security-free Personal Cloud would be Cyberspace’s atomic bomb, capable of devastating millions of lives at one shot.

So, yeah, identity is the new money.  We definitely need to figure out the functionality of identity and the benefits it will bring to the digital world.  But the systems must be designed first for security, privacy, and personal sovereignty because it is from these attributes that functionality arises, not the other way around.

Do We Need an Alternative to HTTPS and TLS?

“Do We Need an Alternative to HTTPS and TLS?”  This question came up in the Personal Clouds list recently.  Thanks to the well publicized problems with Certificate Authorities, variations on this question are a common theme among many of the communities in which I participate.  The CA has become the whipping boy for all the ills of authentication and network security.  Let’s just get rid of it, right?  It’s not that simple.

[Read more…]

Names matter more than you might think

Patrick McKenzie’s blog post Falsehoods Programmers Believe About Names raises some interesting questions about online identity.  He writes: “So, as a public service, I’m going to list assumptions your systems probably make about names.  All of these assumptions are wrong.  Try to make less of them next time you write a system which touches names.”

He then provides a 40-point list of ways in which computer systems break human names acknowledges it is an incomplete list, and asks readers to provide additional examples.  The most egregious item on his list, [Read more…]

FT on How much is your personal data worth?

A recent Financial Times article asks “how much is your personal data worth?”  This sparked a thread on the VRM mailing list to which I’d like to respond.  Tony pointed out that their numbers are old.  I’d also add that the entire article is a bit disingenuous.  The headline “How much is your personal data worth” implies broad valuation as in “how much is a dollar worth?”  The article conveniently ignores many uses and markets for that data and in fact is extremely narrowly illustrated.  It should have read “What is your legally collected data worth to data brokers, assuming you are not a high value target?”

Let’s take these in reverse order.

[Read more…]

Duking it out with miicard

In my never-ending quest to make the world make sense, I have turned my attention to miicard.com once again.  They are pretty good, use HTTPS where it counts, don’t email my stored password around, and I even let them verify bank accounts.  But they are not without some issues.  In the interest of cutting to the chase, I’ve emailed James Varga (CEO) & Stuart Fraser (CTO) links to this post.

[Read more…]

Minimal web security recommendations

For many years now, I have made an effort to contact owners of unsecure web sites and attempt to persuade them to fix the sites.  Lately as I have become increasingly involved with the Personal Clouds and Vendor Relationship Management communities, I have found many unsecure web sites within that community.  These communities are relatively new, fast growing and potentially transformative of Internet commerce and culture at large, so it’s important that security does not become a choke point for growth.  It is also my contention that the consolidation of one’s information into a personal cloud results in greater risk and therefore requires consistently strong and effective security design.  With this in mind, I offer my minimal list of requirements for any non-trivial web site.

[Read more…]