BBC News - Details of 100m Facebook users collected and published

BBC News - Details of 100m Facebook users collected and published

Ron Bowes wrote some software which scanned through Facebook to capture any unprotected personal information from the website.

The collected data has been compiled in to a huge file which is available over BitTorrent among other free channels.

While the program did not access any protected information, it has exposed any and all users who have not taken the proper steps to restrict access to their Facebook accounts, either through error or lack of knowledge, awareness or prudence.

The fact that it has been captured and distributed also makes it impossible to ever effectively change or remove any of the collected information. It is out there in the wild and out of anyones hands or ability to corral or correct.

This link will download the big (2.79GB) compressed database for you right now using a BitTorrent client (it may break at some point).

UK ISP TalkTalk Monitoring its Customers Online Activity Without Consent

UK ISP TalkTalk Monitoring its Customers Online Activity Without Consent − ISPreview UK:

Here we go again with an ISP monitoring users without consent and collecting information about their activities.

In this case the ISP claims to be doing so as part of a project to improve some future security and parental control services. They say that they are not capturing any data about which users visit what sites, but obviously the capability is there. The ISP did not announce this to their customers and only admitted it after it had been discovered and exposed.

Whether the ISP later decided to start capturing that information, the government makes them start capturing it, or a hacker get in to trick the system in to capturing, there is a real likelihood that users of the TalkTalk broadband service in the UK will have their activities captured.

Once again, this shows that you can't trust your Internet providers. Their business is not privacy and their interests do not run parallel to your privacy interests. Only tools which encrypt your Internet activity, like Anonymizer Universal, can protect you against this kind of surveillance by your ISP.

White House proposes warrantless access to Internet activity records

Privacy Digest reports on a new White House proposal to extend the powers of FBI "national security letters" to include gathering of "electronic communication transactional records". While this may appear to be a small change, the potential impact is huge.

These records include all the header information from emails: To:, From:, Time, and often Subject:.

It may also include a list of the full URLs that you visit.

While it does not include the contents of the messages, this level of detail is often more than enough to discover social networks, relationships, intentions, plans, political affiliations, and more.

The real problem is that there are no checks and balances on national security letters. They are issued by FBI offices on their own authority without review by a judge. Historically, self restraint in the face of this kind of power has never worked well. While judges approve the vast majority of subpoenas and search warrants in a timely manor, they can reject egregious cases and the mere fact of their review causes law enforcement to be more restrained in their use.

From the Privacy Digest article:

The use of the national security letters to obtain personal data on Americans has prompted concern. The Justice Department issued 192,500 national security letters from 2003 to 2006, according to a 2008 inspector general report, which did not indicate how many were demands for Internet records. A 2007 IG report found numerous possible violations of FBI regulations, including the issuance of NSLs without having an approved investigation to justify the request. In two cases, the report found, agents used NSLs to request content information "not permitted by the [surveillance] statute."

Privacy survey

In order to help develop better information about public perceptions of on-line privacy, I am posting information about an academic research survey to study just this. I encourage you to fill it out.

Facebook Session Hijack Video

We discovered a major security hole in Facebook almost by accident. The exploit is so trivial I can't justify calling it hacking. Any time you are on an open WiFi and accessing Facebook, anyone else on the same network can easily grab your credential and access Facebook as you with full access to your account.

We have posted a video demonstrating this to YouTube as well as putting it in the Anonymizer Labs section of our website.

New Anonymizer Knowledge Center

We are working hard to improve our website and would welcome your suggestions and feedback on how to improve it.

One new addition is our Knowledge Center where we are trying to share information about privacy and security issues. Within the Knowledge Center we have a section we call "The Lab" (click the tab in the Knowledge Center).

Anonymizer's R&D team is always discovering new and interesting things so we decided we should set up some place where we can share them. To kick off the new section we have posted two videos. The first is a frightening video about Facebook security, and the second is a video of me which introduces the issue of on-line privacy. We plan to post more articles, white papers, and videos going forward.

Google Opt Out Feature Lets Users Protect Privacy By Moving To Remote Village | The Onion - America's Finest News Source | Onion News Network

Google Opt Out Feature Lets Users Protect Privacy By Moving To Remote Village | The Onion - America's Finest News Source | Onion News Network: ""

Finally a viable solution to the privacy problem!!!

Lawmakers To Introduce New Internet Privacy Bill : NPR

Lawmakers To Introduce New Internet Privacy Bill : NPR

Rick Boucher (D-VA) has released draft legislation to significantly increase required privacy notifications for Internet users.

Many websites are fighting the proposed bill, claiming it would hurt their business. I am unsympathetic to complaint that their business would suffer if people actually knew what they were doing with your information. Given that this would apply to all websites, if a policy is no worse than average it should not drive people to other sites.

I would very much like to see the market start to enable competition on the basis of privacy policies.

We shall see how this actually turns out once it has been through the sausage making process. My experience is that most bills about technology end up doing more damage through unintended consequences than they actually help.

Declaration29 - EU plan to retain data on all Internet searches

The European Parliament appears to be trying to create a regulation to require search engine companies to retain total information about their user's searches for a period of years. If you are in the EU area, I strongly encourage you to reach out to fight this.

Declaration29: "A group of members of European Parliament is collecting signatures for a Written Declaration that reads: 'The European Parliament [...] Asks the Council and the Commission to implement Directive 2006/24/EC and extend it to search engines in order to tackle online child pornography and sex offending rapidly and effectively'.

The Data Retention Directive 2006/24/EC requires that details on every telephone call, text message, e-mail and Internet connection be recorded for months, for the entire population, in the absence of any suspicion. As to what is wrong with data retention please refer to DRletter. The Written Declaration even wants to extend data retention to search engines, meaning that your search terms could be tracked for months back.

The proposed declaration has been signed by 371 MEPs (list of names here) - and thus reached the 368 members needed to pass it. Many MEPs signed because of the title of the document ('setting up a European early warning system (EWS) for paedophiles and sex offenders'), not knowing that they are endorsing blanket data retention as well. More than 30 MEPs decided to withdraw their signature, one even on the day of adoption."

ISPs will attach your ZIP to all web requests

This Article on Wired.com is about an initiative by Juniper Networks in collaboration with Feeva to sell a new tracking technology to ISPs.

The enhanced router would be sold to ISPs and will automatically insert your ZIP+4 into HTML headers. This will allow marketers to have much more accurate information about the user's physical location.

They claim that the "consumer is not in any way stripped of their privacy" but fail to actually explain how that is the case. The point is for ISPs to get a piece of the advertising pie. The ZIP will be encoded, not sent in the clear, but will be available to some undefined set of "trusted third parties". That does not give me much comfort.

I have seen many examples of websites which charge different prices based on where you live, or otherwise restrict access to web pages. This kind of targeting does not help me at all. If I want to be located, I have many ways of explicitly telling the site where I am.

This is another example of why you can't trust your ISP. Their interests are not the same as yours. They have a strong incentive to track and monetize your activity.

Fortunately it is easy to take back control. If your traffic is encrypted within a VPN, then the ISP will be unable to insert this information. It gives you the absolute ability to enforce your own "opt out" even if the ISP does not want to give you the option. Anonymizer Universal(TM) provides an easy tool to accomplish this.

Collection of location info on iPhones and others

Many sites, including the Los Angeles Times are reporting on a change to Apple's privacy policy that allows collection and sharing of "anonymous" location information. The only way to prevent this seems to be completely disabling location services on the iPhone.

It appears that Google's privacy policy allows a similar level of information collection.

Much of the chatter I have seen about this issue talks about targeted advertising and user tracking. While I have no doubt that both companies are very interested in doing that I don't think this particular disclosure is about that. Message targeting is more likely to happen within applications where the user has granted explicit permission to push location based advertising and alerts.

I think this is all about improving Enhanced GPS services. My guess (and it is just a guess at this point) is that the phones are reporting back GPS location, Cell tower IDs and signal strength, and all visible WiFi base stations and signal strengths. Given enough of these sets of measurements, they can provide extremely accurate location information given only WiFi information (which takes much less power than GPS and also works indoors). It has been well established that multiple companies, including Google, are building such databases from trucks driving around the world (see my last post).

One purely anecdotal data point I have is from my WiFi only iPad. For background, I live on a fairly large lot and the only WiFi I can detect is my own. One of the first things I did with the new iPad was to open up the map application. It almost instantly centered the location reticule on my house. The only available location information was from the WiFi. I know that the Street View truck has never been through my neighborhood, and doubt that any others have been. My suspicion is that phones used within my house have been providing the correlating data between my physical location and my personal WiFi base station hardware ID.

Google "Street View" vans intercepted sensitive data

Cnet (among others) reports on Google's interception of personal information from open WiFi nodes, including passwords and e-mail.

Clearly it was poor practice for Google to be capturing and recording such information as they drove around, but the real news should be that the information was there to be captured. The intent of the monitoring of WiFi seems to be collecting the locations of WiFi base stations to improve enhanced GPS location services. This works by having your device upload a list of all the WiFi base stations it can see (along with signal strength) which the service then looks up in a database to determine your location. This requires the service to have a database of the physical location of an enormous number of WiFi base stations.

To do this, all Google would have needed to capture was the hardware address of each device. Instead they captured some of the actual data being sent back and forth as well.

It turns out that this is incredibly easy. With many of the WiFi chipsets built in to personal computers, laptops and USB adapters, one can easily download free software that will start intercepting open WiFi traffic with a single click.

The shocking news should not be that Google accidentally got this information but that anyone with bad intent could do it to you. Anonymizer will soon be releasing a video we did a few weeks back showing how someone could take control of your Facebook account using an open WiFi and almost no technical expertise at all.

If the connection between you and a website, email server, or other service is un-encrypted, then anyone near you can intercept it if you are using an open WiFi.

To be clear, open WiFi means that the underlying connection is un-encrypted. Many public WiFi sites have a login page. This is to manage usage, and provides no security to you at all.

If you get a connection before you type in a password, especially if you see a web page before you type a password, then you should assume you are on an insecure connection and therefor vulnerable.

TOR may actually reduce your privacy

WikiLeaks seeded its database of documents by intercepting traffic through a TOR node they were operating.

This article at Wired highlights an almost buried section of this New Yorker interview with one of the founders of WikiLeaks.

Before the WikiLeaks site went live, the founders noticed that hackers were transferring stolen government documents over the TOR network. They captured over a million of these documents to form the initial core of the WikiLeaks archive.

This shows once again what I have been saying for a long time. Any privacy system that allows any untrusted and unknown person to become part of the infrastructure and have access to cleartext information is fundamentally flawed.

Any person with malicious intent can easily set up a TOR node and begin exactly the same kind of data collection that the WikiLeaks folks practiced.

Reputation is everything in this business. It is not practical for typical individuals to properly vet their providers. Track record, reputation, and respected third party endorsements are your best bet when choosing a privacy or security provider. Look for those for everyone who has access to your information.

Copy & Paste intercept / snoop

John Gruber at Daring Fireball posted this interesting article on the growing practice of websites intercepting your attempts to copy text from their pages. They are actually modifying the contents of your clipboard and tracking the fact that you have clipped the information.

The referenced cases seem to be doing it for marketing and informational purposes, but there are many ways this could be used in more aggressive ways.

Imagine a site with sample code which (when copied) inserted some damaging code in to the middle of a large block.

I am worried that this capability exists at all within browsers. It seems like a major security vulnerability to me.

Louisiana: use a map go to jail law

Apparently the legislators in Louisiana feel that crimes committed with an electronic map are much more serious than those committed with the aid of paper maps. Not just some of them, the vote in the Louisiana House approved it unanimously (89-0).

If a "virtual street-level map" is used in the commission of ordinary crimes, a mandatory additional year must be added to the sentence. In cases of terrorism, the penalty is 10 years.

This should prove a boon to the sellers of Thomas Bros. high resolution map books.

The unanimous nature of this decision makes it clear the degree to which our leaders lack any political spine. They are obviously concerned that voting against this will appear "soft on crime" despite the fact that this will have no real impact at all, and is trivial to circumvent. It is a waste of time and attention on what Bruce Schneier calls "Security Theater".

New Privacy Settings for Facebook

On May 26th Facebook announced new privacy controls. The EFF has a nice tutorial on how to properly configure these new settings to best protect your privacy.

Unfortunately these new settings options are being rolled out slowly. At this point I still don't have the ability to use the new settings at all. If you are lucky enough to have been moved to the new system, update those settings ASAP.

US Apologizes to Billionaire Added to Terror No-fly List - ABC News

US Apologizes to Billionaire Added to Terror No-fly List - ABC News It looks like there is a process for dealing with inaccurate No-Fly List information after all. You just need to become a billionaire and develop some very high level political connections.

Privacy and Corporations at CFP Conference

I am very excited to be organizing a couple of panels at this year's "Computers Freedom and Privacy" (CFP) Conference in San Jose June 15-18.

Historically the conference has focused on personal privacy / freedom issues, technologies, and policies. That was certainly my focus as well when I started Anonymizer. Over time I have become aware of some other aspects to the privacy issue that I have not seen discussed. In addition to corporations impacting privacy of their customers, users, employees, etc. they also have issues and needs for privacy themselves.

Companies activities are monitored, analyzed, blocked, misinformed, and censored. While these have analogs in the personal privacy world, the details, impacts and scale, and solutions to the problems are often very different.

I am organizing a panel to discuss these issues at the conference and would love to hear from others who may have experienced these kinds of issues and would be willing and able to share them at this conference.

Cypherpunk retrospective at 20th anniversary CFP conference

This year the "Computers Freedom and Privacy" (CFP) conference is taking place in San Jose from June 15-18. This year is the 20th anniversary of the conference which helped shape my thinking about Internet Privacy and introduced me to many of the key players in this space.

Around the same time in 1992 an email mailing list started called "Cypherpunks". Members were devoted discussions of Internet freedom and to creating and distributing privacy and security tools. Best known of these are the various flavors of Anonymous Remailers following the original anon.penen.fi.

This seems like a good time to stop and take stock of what has been achieved, lost, and abandoned in the evolution of privacy and anonymity on the Internet. I have organized a panel at CFP of some of the key Cypherpunks from the early days to talk about those early days, and share their vision and insight about where we are and where we should / are likely to end up.

I hope I will see many of you there.

IntelFusion - Use a proxy server. Feed an Intel service.

Read this post from IntelFusion. It makes a very strong case for why I worry about any privacy system run by operators you can't really trust, investigate, and verify. In this case it is an investigation of Glype servers. They can be configured to do significant logging, and the author has been able to remotely retrieve the logs from many of the Glype servers. The results show many users from within sensitive US Government organizations and would provide the ability for an attacker to gather all kinds of useful intelligence to find soft targets to exploit. On the personal privacy side, it is an easy way for attackers to intercept usernames, passwords, travel plans, personal information and more for use in, identity theft, burglary, and hacking among other things.