Who wants to be safe? Online protection as a black box

~~~

[6 min read]

Hacking that affects individuals is very widespread. The Pew Research Center reports nearly 2/3 of online Americans have experienced some form of data theft. A total of about 50% of onliners think their personal data are less secure than five years ago (see previous post for other details).

What does “data theft” look like? Pew examined seven types, and found that only two – fraudulent credit charges and stolen tax refunds – entailed direct financial loss. The others involved some less definable harm, such as an attacker getting his hands on social security numbers or login credentials for social media accounts. We call it “compromising” the data.

This amorphous concept of “compromised data” is growing into one of the chief barriers standing in the way of advances in cybersecurity for end-users. It takes what’s already invisible and annoying (see: strong passwords), and adds a hefty dose of abstraction. Exactly when can we say a piece of data has been sufficiently “compromised” to start worrying and take action? What kind of action?

WhatsApp: how secure?

Let’s look at WhatsApp to see how a popular messaging service handles security for a billion users – and how adding security can actually lead to trouble as well as safety.

Last year WhatsApp announced deployment of end-to-end encryption (E2EE) for all messages and media crossing its systems. Their FAQ assures users that everything they send is “secured from falling into the wrong hands” – right from the sender’s device all the way to the recipient’s (hence “end-to-end”). Marketing wants to be reassuring, not to mention emphatic as to why their platform is better than competing platforms. Continue reading

Security fatigue: problems in password paradise

________

[5 min read]

A new survey from the Pew Research Center paints a bleak picture of how Internet users feel about their online security. The report starts with bad news about passwords, the high profile tool in the toolkit: “69% of online adults say they do not worry about how secure their online passwords are.”

How does not worrying look in real life?

Consider the findings from Keeper, a vendor of password management software. It recently tallied its annual list of the world’s favorite passwords. The top 10 list opposite, taken from an analysis of 10 million sample passwords, illustrates pretty well what end-users mean by not worrying. These passwords are so terrible that the estimated crack time for the “safest” choice on the list (#6) is about 9/1000 of a second – for the others, the effective crack time is zero seconds. This preference for easy – and insecure – passwords goes hand in hand with a set of attitudes to online security that’s not easy to fathom.

To begin with, Pew notes a tension between lack of trust in institutions and reluctance to take personal action on security:

“[While] they express skepticism about whether the businesses and institutions they interact with can adequately protect their personal information, a substantial share of the public admits that they do not always incorporate cybersecurity best practices into their own digital lives.”

Internet users are right to feel skeptical. Site operators as varied as Target, Ashley Madison and Yahoo! have shown they’re not only lousy at network security, but irresponsible in disclosure and damage control. In December, Yahoo! admitted that hackers had breached its systems and stole information from one billion accounts – and had done so three years before management got around to discussing the attack publicly.

A second and more counter-intuitive finding concerns what people do in response to suffering from an actual online attack:

“Americans who have personally experienced a major data breach are generally no more likely than average to take additional means to secure their passwords (such as using password management software).”

What explains such quick dismissal of self-interest?

Despite being a part of daily life, I think most people find passwords not just difficult but, well, weird. The better they are, the worse they are, since what makes them hard to crack also makes them hard to handle. Unlike, say, car locks and safe deposit boxes, passwords work invisibly on assets that are also invisible. Even as we type them, they dissolve into rows of inscrutable little dots. Plus they’re often stored on remote servers, i.e. in the “cloud” – the perfect metaphor for a tool you can’t see or understand.

Perhaps this abstract quality is what prompts people to manage their passwords in another kind of remote cloud: their brains. Two-thirds of onliners (65%) say memorizing their passwords is their most used strategy, while 86% use memorizing as at least one approach. The way distant second? Writing passwords on a piece of paper, the most used method for only 18% of respondents.

Software developers look at this behavior and think they can put us out of our misery by selling us password management software – 1Password, Dashlane, Keeper, etc – the tools security experts recommend most highly.

The bad news, however, is that almost nobody uses them. A mere 12% of onliners say they use these applications at least sometimes, while those who say they use a password manager most often amount to a tiny minority of 3%. Pew cautions this is not niche behavior, as password software “is used relatively rarely across a wide range of demographic groups.”

There’s a useful lesson here.

People at the selling end of the consumer tech business see code as the solution to everything. If you have trouble remembering your passwords and that makes you unsafe and you’re generally miserable about it all, then you’re gonna love our software. What’s wrong with this logic is not how good the software is or how cheap or how user-friendly. The problem is that it’s software.

This mental fatigue extends far past security. It’s only part of the fallout from how mainstream consumers are taught to behave in the digital world – to expect everything we touch to be effortless, easy and user-friendly, even when it clearly isn’t. Vendors know their customers won’t take lessons, respond to scares or read the manual so they just pretend there’s nothing to learn in the first place.

Same deal with hardware. As a tech at the Apple Genius Bar once explained to me, customers come in with broken, manhandled $1500 machines they’ve never maintained or even cleaned, and leave with their repair ready for more abuse. Imagine treating a $1500 Weber gas barbecue that way.

The only way mainstream consumers are ever going to make peace with their devices – and their passwords – is by getting to know them better. Mystification is a terrible motivator, as I can attest after a decade teaching 20-somethings how their digital world works.

Getting this particular demographic to put down their phones, their ingrained habits and their fear of exploring technology (yep, you heard that right), is hard work for all. Like most people, students have been persuaded there must be an app for that – one that will allow them to learn how a data packet crosses the Internet without any effort on their part. Or while texting. Well, there isn’t and there won’t be.

I see a wholesale change in our approach to understanding digital technology as one of the most important educational missions of the next decade. I’ll be writing more about this educational challenge in the coming weeks and months.

(The Pew survey on cybersecurity is available here.)

D.E.

Continue reading

Smart objects, dumb ideas: your hyperconnected future (Pew/Elon 2016)

crestron-control-panel

We’re all going to hell in an IP-enabled handbasket.

The bland-looking control panel depicted above is the heart of a smart home – automated up the wazoo, so your fingers can play master of the universe with the lighting, audio system, appliances, heating and cooling, sprinklers, pool, spa, garage door – and your alleged security system.

Alleged because smart homes, cars and all the other items you’ll be connecting to the public automated-cat_feederInternet will offer unprecedented opportunites for hackers to infiltrate your life. Most personal devices like computers are already insecure enough. But so-called “smart” devices will be far more difficult for consumers to organize, update and secure than the familiar devices we can see and hold. (If you think any object in our lives will be spared, check out the automated cat feeder adjacent, courtesy Wikipedia.) Continue reading

Why algorithms are bad for you (Pew/Elon 2016)

al-khwarizmi

Statue of al-Khwārizmī, the 9th-century mathematician whose name gave us “algorithm”

~~~

I’ve written a lot about the Pew Research Center. Pew does a great deal of invaluable survey research on the behaviors and attitudes we develop online (okay, “we” means American here). In a departure from the science of probability surveys, Pew teamed up with researchers at Elon University back in 2004 to launch their Imagining the Internet project.

future-pew-elon

About every two years, the team prepares a set of questions that’s sent to a list of stakeholders and experts around the world. The questions reflect current hot-button items – but ask the participants to imagine how online trends will look a decade from now. The topics have ranged from broad social concerns like privacy and hyperconnectivity, to more technology-oriented questions like cloud computing and Big Data.

The 7th version of the survey was fielded this summer; it’s my 4th shot at predicting what life will be like in 2025. (For a look at what the survey tackled in 2014, see my posts starting with one on security, liberty and privacy.) Continue reading

Et tu, Reed? Big media’s war on privacy (3)

hastings-privacy-2

Netflix CEO Reed Hastings tells investors what he thinks of privacy advocates

~~~

Back in March I wrote two posts to express my surprise and frustration that Netflix would no longer let its customers gain entry through a VPN or virtual private network. Turns out the problem hasn’t gone away. Also turns out Reed Hastings is still every bit as dismissive of our privacy concerns – and our customer experience – as he was in January.

A lot of the recent coverage of the Netflix vs privacy phenomenon was prompted by my colleagues at OpenMedia, and in particular Laura Tribe, who acts as the advocacy group’s digital rights lead. When I spoke to her this morning, she pointed to the large number of media outlets that have covered the OpenMedia campaign against the Netflix VPN blockade (OpenMedia pays me from time to time as a policy consultant).

In an email letter to supporters last Friday, Laura and her team laid out the case, opening thusly:

Is protecting your privacy and security “inconsequential?” That’s what Netflix CEO Reed Hastings seems to think, based on recent comments reported in WIRED magazine.

It’s time to remind Netflix that privacy and security matter to us. Yesterday your open letter made international headlines.

If you want to throw your name in the ring, the OpenMedia campaign page for Netflix is here. Continue reading

Why is Reed Hastings bent on killing my privacy? (2)

ntflx-lulzsec-1

~~~

Hollywood vs the Boston Strangler

jack_valenti_4The Kings of Content have always shown an intense and belligerent dislike for new technologies, regardless of their promise or popularity. History is littered with the embarrassing results. Take Jack Valenti.

For over 35 years, Valenti was head of the Motion Picture Association of America (MPAA). In 1982, the studios were in court trying to prevent Sony from shipping a single VCR to the US because of the alleged threat of piracy. Here’s how Valenti famously described the dangers of the VCR to a Congressional committee:

“I say to you that the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone.”

Continue reading

Why is Reed Hastings bent on killing my privacy?

netflix-vpn-error-collage

“I don’t think we will see any impact.” — Reed Hastings, January 19

“The VPN crackdown is meeting fierce resistance from privacy activists and concerned users, with tens of thousands calling upon the streaming service to reverse its broad VPN ban.”Torrent Freak, Feb 26

~~~

Since Netflix came to Canada in September 2010, I’ve written 51 posts carrying the Netflix tag. I’ve sung the praises of Reed Hastings; objected to the anti-Netflix manipulation of data caps by our incumbents; defended Netflix’s right to operate in Canada over the self-serving protests of our media establishment; and sympathized with Netflix for the archaic treatment meted out to streaming services by the CRTC.

Netflix-6.0-for-iOS-app-icon-smallThe longest pair of posts I’ve ever written (about 6,000 words) was on the attempt by the CRTC and selected media barons to make life as difficult as possible in Canada for Netflix. That was 2011: Get yer grimy paws off my Netflix: Ottawa’s big OTT scam (part 1, June 16; and part 2, June 18).

There was a single exception. I fell off the wagon when Netflix linked arms with Facebook and produced one of the worst privacy policies I’ve ever read: Netflix showing way too much love – for your Facebook data (Oct 2011).

Which brings us to the much bigger privacy problem Netflix has created for itself. Continue reading

Rebooting basic services: hope for policy reform? (2)

turcke-crt-1

New ideas for policy reform from Bell

~~~

Update on other reactions to Turcke/Bell (1:10pm): Pete Nowak has his own biting critique in yesterday’s post – If VPN use is theft, then Bell’s CraveTV is extortion. And over at OpenMedia.ca, Josh Tabish has stirred up some really unfriendly reactions on Facebook about the whole fiasco – 181 315 and counting. (When I showed the FP article to my teenage daughter, her eye-rolling reaction was, OMG, as if using a VPN is hacking.)

As I suggested in my last post, some of the conclusions reached at the Rebooting conference will be echoed in the current CRTC proceeding on basic service objectivesDespite all the compelling reasons for reform, however, numerous barriers stand in the way. Some of those discussed at the conference will certainly play a continuing role in the broadband proceeding…

1 – No political will or vision. Short of improbable legislative change, we need something the Harper government is incapable of formulating: a national digital strategy. The CRTC suggested the need for a national strategy six years ago in its new media decision (2009-329, para 78). What we got from the Tories instead was a lousy marketing brochure. Even the opposition parties seem to regard our broadband future as unworthy of serious attention. Continue reading