India Censorship - on then off again

in , ,

India thumbs down India recently announced that all ISPs in the country will be required to block a list of over 800 websites. They claim all of these were for pornography or child pornography, but it turns out that was not the case for all of them. In the face of a massive backlash, the telecom ministry first said this was no big deal because people could use VPN services to bypass the censorship. They later down entirely.

Obviously this huge number of people protesting this move we're not all pedophiles but rather people who understood that this kind of censorship often leads to much broader and politically based censorship. At Anonymizer are we noticed a huge surge in the amount of traffic and sign-ups coming from India during this situation.

It is very important to set up your anti-censorship tools before you actually need them. It is easy for governments to block a website like Anonymizer.com, your service might continue to work for very long time but you would not be able to sign up in the first place once the censorship is put in place.

https://www.youtube.com/watch?v=9NZL8D-p6FY

[powerpress]

Security risk of Uber abusing trust & tracking reporters

in , , ,

Party in limo In two separate cases recently Uber has, or has talked about, abusing its information about their customer’s movements.

First a Buzzed reporter Johana Bhuiyan was told that she was tracked on the way to a meeting by Josh Mohrer, general manager of Uber New York.

Next Emil Michael, SVP of business for Uber, talked at a private dinner about the possibility of using the information Uber has about hostile reporters to gather dirt on them.

Apparently Uber has an internal tool called “God View” which is fairly widely available to employees and allows tracking of any car or customer. Obviously such information must exist within the Uber systems for them to operate their business, but this access for personal or inappropriate business purposes is very worrying, possibly putting the security of customers at risk.

While Uber is the company that got caught, the potential for this kind of abuse exists in a tremendous number of businesses. We give sensitive personal information to these companies in order to allow them to provide the services that we want, but we are also trusting them to treat the data appropriately.

Last year there was a scandal within the NSA about a practice called “LOVEINT”. The name is an inside joke. Signals intelligence is called “SIGINT”, human intelligence is called “HUMINT”, so intelligence about friends and lovers was called “LOVEINT”. In practice, people within the NSA were accessing the big national databases to look up information on current or former partners, celebrities, etc.

The exact same risk exists within all of these businesses, but generally with far weaker internal controls than in the government.

I think that the solution to this is not to insist on controls that would be difficult to enforce, or to ban the keeping of information which they really do need, but rather to give users visibility into when their information is viewed, why, and by whom. Abuse could then be quickly detected and exposed, while allowing the business to continue to operate as they need to.

https://www.youtube.com/watch?v=XM8_JeVHwwo

[powerpress]

Good articles for more info from: The Verge, Forbs, & Forbs again

Protect your security from ISPs stripping email encryption

in , , , ,

Cricket Engineers at Golden Frog recently discovered that Cricket wireless was automatically disabling their email encryption.

It is not at all clear why they were doing this, but we do know how. When an email client attempts to make a secure connection to a server, it sends a STARTTLS command. If the server never sees the STARTTLS, then it assumes you just wanted an insecure connection.

The ISP can easily modify the data stream to remove the request, causing your computer to connect without any encryption. According to the standard, the user is supposed to get a warning about this, but in practice almost all software just fails silently.

The best way to protect yourself against this attack is to encrypt your email end to end. You can use SMIME, which is built into most email clients, or GPG. GPG can be stronger, but it is harder to use, and easy to misuse. Either will significantly improve your security.

The next step is to use a VPN like Anonymizer.com to protect you against your ISP. It will also protect you against anyone else in the path between your computer and your VPN service. Unfortunately between them and the destination server, you are still vulnerable to any hostile ISPs.

https://www.youtube.com/watch?v=aHtVjZJxO_Q

[powerpress]

Some other articles on this attack: Arstechnica, & The Washington Post

Also read:

Lance Cottrell is the Founder and Chief Scientist of Anonymizer. Follow me on Facebook, Twitter, and Google+.

Dropbox and bad password hygiene

in , ,

Empty Cardboard Box The recent incident where attackers posted usernames and passwords for compromised Dropbox accounts really shows the importance of practicing good password hygiene.

GigaOm has one of many articles describing the actual events. The short version is that some hackers have been posting usernames and passwords to Dropbox accounts on a Pastebin page. Dropbox says that they have not been compromised, and that the passwords were actually taken from other websites or through other methods.

If this is true, and it seems reasonable, then those who have been compromised became victims because they reused their passwords across multiple websites. That is probably a bigger security error than choosing weak passwords in the first place.

The security at websites varies widely, usually based on the sensitivity of the information on that site. Banks tend to have better security than news sites or discussion sites. If you use the same password with all these sites, then if any of them is compromised the attacker can simply try your username / password on every other interesting website to see if they work there too.

The solution is to use a different password on every website. They should not be simply modifications of each other but actually completely different passwords. Additionally they should be long and random. This means that they will be impossible to remember, but a password manager or password vault can take care of that for you. It will generate the strong random passwords, fill in the forms for you, and sync between your various computers and other devices. There is no excuse not to use unique and strong passwords with every website, and you will be much safer if you do.

https://www.youtube.com/watch?v=XS7cyv_4o8A

[powerpress]

Lance Cottrell is the Founder and Chief Scientist of Anonymizer. Follow me on Facebook, Twitter, and Google+.

2 Apple security fumbles: Random MAC and Password Prediction

in , , ,

Apple Store Chicago Apple is getting taken to task for a couple of security issues.

First, their recently announced “Random MAC address” feature does not appear to be as effective as expected. The idea is that the iOS 8 device will use randomly generated MAC addresses to ping WiFi base stations when it is not actively connected to a WiFi network. This allows your phone to identify known networks and to use WiFi for enhanced location information without revealing your identity or allowing you to be tracked. Unfortunately the MAC only changes when the phone is sleeping, which is really rare with all the push notifications happening all the time. The effect is that the “random” MAC addresses are changed relatively infrequently. The feature is still good, but needs some work to be actually very useful.

Second, people are noticing their passwords showing up in Apples iOS 8 predictive keyboard. The keyboard is designed to recognize phrases you type frequently so it can propose them to you as you type, thus speeding message entry. The problem is that passwords often follow user names, and may be typed frequently. Research is suggesting that the problem is from websites that fail to mark their password fields. Apple is smart enough to ignore text in known password fields, but if it does not know that it is a password, then the learning happens. It is not clear that this is Apple’s fault, but it is still a problem for users. Auto-fill using the latest version of 1Password should protect against this.

https://www.youtube.com/watch?v=ceC9jMIpszI

[powerpress]

Lance Cottrell is the Founder and Chief Scientist of Anonymizer. Follow me onFacebook, Twitter, and Google+.

The Privacy Blog Podcast - Ep. 22

in

Standard Profile PictureWelcome to episode 22 of the Privacy Blog Podcast for July, 2014.In this episode I will talk about:

  • A recent revealed compromise of the Tor anonymity system
  • Why Canvas Fingerprinting both is and is not a big deal
  • The coming conflict between US searches and EU privacy
  • How even genealogy information can compromise your identity
  • An update on Chinese censorship
  • Why the security model of the web is hopelessly broken
  • Russia’s continuing crackdown on the Internet
  • and finally how Lightbulbs, among other things, can
  • compromise your network

The Privacy Blog Podcast - Ep. 21:

in , , , , , , , , , ,

Standard-Profile-Picture.jpgIn episode 21 of our podcast for July, I talk about:

  • A decision giving Canadians more rights to Anonymity
  • Iraq's recent blocking of social media and more
  • Iran's outright criminalization of social media
  • A court decision requiring warrants to access cell tower location data
  • Another court stating that irrelevant seized data needs to be deleted after searches
  • A massive failure of data anonymization in New York City
  • A court requiring a defendant to decrypt his files so they can be searched
  • The Supreme Court ruling protecting cellphones from warrantless search.
  • Phone tracking streetlights in Chicago
  • And a small change for iPhones bringing big privacy benefits

The Privacy Blog Podcast - Ep. 20: Censorship, passwords, NSLs and cash

in

Standard-Profile-Picture.jpgIn episode 20 of our podcast for May I talk about:

  • The need to target your privacy efforts
  • Why your secrets may not be safe with secrecy apps
  • The possibility of more light shining on National Security Letters
  • Conflicted feelings about censorship in the Russian government
  • Google and the right to be forgotten
  • What you need to do to deal with all these password breaches
  • A demonstration of a stealthy camera snooping app for Android
  • and a quick announcement about Anonymizer

The Privacy Blog Podcast - Ep. 19: Heartbleed, IE, and Internet Sovereignty.

in

Standard-Profile-Picture.jpgIn episode 19 of The Privacy Blog Podcast, recorded for April 2014, I  talk about:

  • The Heartbleed bug, and why it is such a big deal.
  • A major vulnerability in Internet Explorer, and why we are focusing on the wrong thing.
  • The reasons behind recent pushes for national Internet sovereignty.
  • and finally about the increasingly international reach of US search warrants.