Tor: A Reason for Enthusiastic Discussion
October 21, 2018
The Tor Web browser was designed by the Naval Research Institute to protect journalists, human rights activists, and freedom fighters avoid detection in authoritarian governments. However, bad actors also use the browser to power the Dark Web to sell drugs, child pornography, weapons, illegal goods, participate in human trafficking, offer assassination services, and more. Homeland Security investigates in the story, “Is Tor Doing More Harm Than Good? Experts Weigh Costs Of Dark Web.”
In May 2018, Virginia Tech held a Dark Web forum that discussed Tor’s impact and whether it was a force for good or bad. The Tor browser is very much like the Internet. When the Internet was first launched it was lauded as a force for good, increasing access to information, communication between people, and more. With the good came the bad, including a new level of crime soon dubbed cyber crimes ranging from child pornography to selling illegal goods. Sound familiar? The Tor Project is supposed to be a force for good and the US State Depart, National Science Foundation, and individuals fund it. Is it worth continuing
“ ‘It’s becoming a place where certain classes of criminals can act with impunity,’ said Gareth Owenson, a senior lecturer in the School of Computing at the University of Portsmouth. ‘At the moment, the U.S. government funds Tor because it believes it is a force for good, that it is promoting human rights in other countries. My view, having studied it for almost five years now, is that overwhelmingly the harm outweighs the good.’”
Eighty percent of the Dark Web sites are dedicated to child pornography in 2014, but it has been reduced to forty percent as of 2018. Bitcoin and other crypto currencies also power the Dark Web. Anonymity is the big draw to the Tor browser and crypto currencies.
Is Tor able to deliver anonymous Web browsing? Sure it is.
Whitney Grace, October 21, 2018
Google: Privacy May Be a Relative Concept
October 3, 2018
Google is concerned about its users privacy. It has options for users to turn off data sharing to protect their privacy. Google says it has these options…supposedly. Fortune shares how Google is breaking its privacy promises in the article, “Google Admits That It Lets Outside Services Share Your Gmail Data.” Google said last year that it would stop scanning users’ emails for keywords to use for targeted ads, but they lied.
When confronted with the deception, Google admitted to the subterfuge and also that they allow third parties to share user information with other third parties. The third parties are supposed to alert users how their information is being used. Does that happen? Probably not.
We learned:
“As Google explained in a blog post following the initial story, the kinds of third-party services that it allows to plug into Gmail include email clients, trip planners and customer relationship management systems. These services, which Google claims to thoroughly vet, typically read emails in an automated way, although humans do sometimes read them too. Users need to actively permit the apps to access their Gmail accounts, and they can revoke permission afterwards. However, Google’s blog post did not talk about the possibility of those third-party services sharing users’ data with other third parties.”
Users apparently had no idea that their data was being shared and Google did not inform them. Google’s privacy policy is broken and they might get away with it in the US, but Europe requires way more transparency. Once again this more proof that the almighty dollar trumps user protection.
Whitney Grace, October 3, 2018
Web Search with Privacy: SearX
August 24, 2018
For far too long we have been living in the Wild West of search: there are too few rules and personal data has been far too fluid. While we wait for the Googles of the world to change their policies (fat chance!) the time has come to find alternatives for those of us who care about keeping their privacy a top priority. We learned more about this revolution from a Make Use Of story, “Avoid Google and Bing: 7 Alternative Search Engines That Value Privacy.”
According to the story:
“Functionally, SearX is a metasearch engiyne, meaning it aggregates data from a number of other search engines then provides you with the best mix available. Results from several of the other search engines on this list—including DuckDuckGo, Qwant, and StartPage—are available. You can customize the engines that SearX uses to find results in the Preferences menu.”
Is a new search engine the answer? Probably not likely. In another time, we might point to the idea that the world has room for more search engines, but with the rise of voice search and the amount of money needed to research this type of thing, the odds of a new search engine taking over for Google or the like is very much impossible. There are other privacy centric Web search systems; for example, Unbubble.
The question becomes, “Are these systems private, or are the data available to authorities with the proper documentation?” Marketing is different from privacy for some people.
Patrick Roland, August 24, 2018
A New Cyber Angle: Differential Traceability
August 20, 2018
Let’s start the week with a bit of jargon: differential traceability.”
How do you separate the bad eggs from the good online? It’s a question we’ve all been wracking our brains to solve ever since the first email was sent. However, the stakes have grown incredibly higher since those innocent days. Recently, some very bright minds have begun digging deeply into the idea of traceability as a way to track down internet offenders and it’s gaining traction, as we discovered from a Communications of the ACM editorial entitled: “Traceability.”
According to the story, it all comes down to differential traceability:
“The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners.”
Giving everyone a tag, much like a car, for Internet traffic is an interesting idea. However, much like real license plates, the only ones who will follow the rules will be the ones who aren’t trying to break them.
This phrase meshes nicely with Australia’s proposed legislation to attach fines to specific requests for companies to work around encryption. Cooperate and there is no fine. Fail to cooperate, the company could be fined millions per incident.
Differential? A new concept.
Patrick Roland, August 20, 2018
Google and GPS Tracking
August 13, 2018
You will want to chase down the full text of “Google Tracks Your Movements, Like It or Not.” I read the AP story in Chron. Note that I try not to quote from AP stories because I have zero desire to get involved in a fair use hassle with a large entity like the AP.
The main point of the story, which I assume is accurate, is that Google tracks where its customers go. The location data functions of a mobile phone provide the stream of data. The story asserts that Google collects these data even if the user has made changes to the default settings in the mobile device to disable tracking.
My understanding of the news report is that Google says a user can disable tracking. The AP story asserts that Google is not telling the truth. Thus, the AP asserts, Google possess location data on more than one billion users.
The AP story reports that Google says it is following the white lines set forth in its configuration tools exposed to the user.
Beyond Search finds the assertions interesting. The sources cited in the article include a university researcher from Yale and a graduate student at University of California-Berkeley.
Geolocation functions are “baked in” to most mobile devices. Numerous companies make use of these data. Some companies assert that they can derive location data by cross correlating a range of user generated data inputs. Microsoft invested in Hyas, a firm which allegedly has such capabilities. Our research suggests that Amazon has a similar capability for certain customer applications as part of its streaming data marketplace platform.
Many mobile devices make it possible to obtain location data even when the device is turned off and software settings are configured to disable location information. Specialist firms can disable the GPS circuitry to create “dark phones.” One rumored device with these capabilities is produced in the Middle East. If one has a mobile with a removable battery, the device goes “dead” when power is cut off. Also, Faraday bags make it difficult for monitoring and receiving devices to capture a mobile device’s location. (One option is the Blackout Faraday Shield, and there are bags which cost as little as US$10.)
Net net: The AP story seems to be more about Google doing something in an underhanded way than about GPS data widely used by law enforcement and intelligence professionals.
Beyond Search thinks the story would be more interesting if workarounds like the Faraday bag option were explained. Informed consumers can easily protect their location if and when desired. The singular focus on Google is less useful than a broader, more informed look at GPS usage.
When you read the original AP full text story, you can decide if the write up has an anti Google bias. In Harrod’s Creek, use of GPS data is routine. Google is continuing its personalization methods which have been part of the firm’s systems and methods for many years.
Finding fault with successful online companies may be the new blood sport for traditional news and publishing enterprises anchor4ed in the world of print.
Stephen E Arnold, August 12, 2018
Are Some Google Docs Exposed to Web Indexing Systems?
July 21, 2018
Recently, Russian search giant Yandex reported seeing Google Docs turn up in search results. Previously, this was thought to be impossible. However, this brings up a lot of questions that others have taken for granted: namely, how secure are documents on the cloud? This was looked at more closely in the Media Post story, “Private Google Docs Serve Up In Yandex Search Engine Results.”
According to the story:
“[O]ther search engines can only serve up Google documents that had either been deliberately made public by its authors or when a user publishes a link to a document and makes it available for public access and search… Saving and protecting users’ personal data is our main priority for search engines. A Yandex spokesperson said the search only yields files that don’t require logins or passwords.”
For its part, Google appears to deflect the Yandex observation. Regardless, the Yandex assert arrives near the muddy heels of other security woes like the idea that our Gmail messages and their content could be used by developers. With the Android matter behind it, the EU may look at access to certain Google content.
Patrick Roland, July 21, 2018
Facebook: Information Governance?
July 9, 2018
Anyone else annoyed by the large amount of privacy disclosures filling your index and slowing down your favorite Web site? User data privacy and how companies are collecting and/or selling that information is a big issue.
Facebook is one of the more notorious data management case studies. Despite the hand waving, it may be easy for Facebook data to be appropriated.
Josip Franjkovi? writes how user data can be stolen in the post, “Getting Any Facebook User’s Friend List And Partial Payment Card Details.”
There are black hat and white hat hackers, the latter being the “good guys.” It is important for social media Web sites to hack themselves, so they can discover any weaknesses in their structures. Franjkovi? points out that Facebook uses a GraphQL endpoint that is only accessible their first part applications. He kept trying to break into the endpoint, even sending persisted queries on a loop. The same error message kept returning, but it did return information already available to the public and the privately held friends list.
The scarier hack was about credit card information:
“A bug existed in Facebook’s Graph API that allowed querying for any user’s payment cards details using a field named payment_modules_options. I found out about this field by intercepting all the requests made by Facebook’s Android application during registration and login flow.”
Thankfully Franjkovi? discovered this error and within four hours and thirteen minutes the issue was resolved. Credit card information was stolen this time around, but how much longer until it is again? We await Franjkovi?’s analysis of Google email being available to certain third parties.
Whitney Grace, July 9, 2018
Online Memory: What Is Out There?
July 6, 2018
Facebook is an excellent company for most people. However, there are a handful of people who struggle to accept Facebook’s approach to reality. What happens when a chunk of digital memory becomes almost permanent?
The aftermath of the European Union’s “right to be forgotten” law that allows people to petition search engines and other data aggregators to delete search results on them permanently removed. While some believe this infringes on various forms of free speech, others believe this is a way for crime victims to reclaim their lives. Quartz shares how Google and Facebook are not the only Web companies being petitioned in the article, “Meet Profile Engine, The ‘Spammy’ Facebook Crawler Hated By People Who Want To Be Forgotten.”
According to the article, Google had the most Facebook results removed from its search engine, while the second most Web site to be requested to delete results is Profile Engine. Profile Engine started in 2007 and allows users to track down people on social network. It used to be a Facebook search engine, but the Profile Engine declared that Facebook was “spammy” and did not make truthful statements. Interesting assertion.
Profile Engine and Facebook had an argument, which resulted in a court battle. The two companies split, but Facebook is contractually obligated to keep feeding Profile Engine results. Facebook does not do this. In the meantime, Profile Engine stopped updated content around 2011. Facebook is not the only one that finds the Profile Engine interesting. There are many posts online about how to remove yourself from Profile Engine.
“Profile Engine is perhaps the worst of its kind, but not the only one that people across Europe are trying to expunge themselves from. Badoo, a London-based social network for meeting new people, had 2,206 results removed. Yasni—”News, pictures & links for any person. Find anyone on the internet with the world’s largest free people search”—had almost 3,000 results suppressed through its French and German subsidiaries. In other words, this battle of ownership of personal data is not going away anytime soon.”
Profile Engine was donated to the Internet Archive, so now all the results are located there. Effort may be needed to get information removed from the Internet Archive. It takes time and patience for Google to forget. Facebook type content may be almost permanent as well.
Whitney Grace, July 6, 2018
Search History? No Big Deal Maybe
June 29, 2018
What you search for leaves a digital footprint, or more accurately, a fingerprint. So much identifying data is left behind in your search history. However, there are some angles to this predicament many people are overlooking. We realized just how much bad information people are getting after reading a recent Pagal Parrot article, “Searching These Five Things Can Make Trouble For You.”
This odd little story seems to really give some elementary advice on what not to search for, like:
“#2 Your Name- It’s not a big secret that in this era of the internet our privacy questioned. If you try to Google most probably you will get stumble upon some unpleasant results, bad photos of you, outdated information, irrelevant content. we take such things way too seriously. If you find something like this, you want to delete it.”
This is a little obscure, considering there are such worse implications of your search history. For one, it informs all the bots what is sent through your social media feed. So, for example, a simple search about fake news might just land you with a glut of bogus stories. Thankfully, there is better advice out there than not searching your name, like how to wipe your Facebook and Google search history so that you aren’t fed to the algorithm monsters. Much more practical, in our book!
Patrick Roland, June 29, 2018
Cheerleading for VPNs: Gimme a V, Gimmie an S, Gimmie an N!
June 20, 2018
VPNs Protect Your Data Away From Home
The received wisdom is that a VPN or virtual private network can be used to protect your Internet data from hackers and other bad actors. ZDNet wrote up a piece about VPNs in “Take Home Along: Six Ways A VPN Can Help Travelers Connect Wherever They Go.” Typically remote access from a different country or area than your normal IP area will be flagged as a bad actor, but it can also protect you.
In theory, you can use a VPN to prevent your debit or credit card from being blocked, do home online shopping, watch your streaming services, and use VOIP services. While these are apparent application for a VPN, the article also shares some other that are “naughtier.”
If you are visiting a country, like China, that has restricted access to social media then a VPN in theory will allow you to circumnavigate it. Even more helpful is that it can hide your online tracks from spies:
“Some companies provide VPN access to their employees while traveling. Employees are given software or configurations that allow them to create encrypted tunnels between their laptops and home servers. These enterprise VPN clients do a great job of hiding the content, but they fail in one critical way: They often let a spying nation state know the IP address of those VPN end-points.
The hope is that by using a VPN service provider, you can obfuscate the path back to work, as well as the data you’re transmitting. This is a very good idea to make it just a little harder for nation-state spies and the organized crime hackers that often work with them to find your company’s servers.”
The problem is that not every VPN is fully secure. Why? In some countries, those who use and operate VPNs are either expected to cooperate with the authorities or just want to stay in business and maybe out of jail.
Whitney Grace, June 20, 2018
-
- Subscribe to Beyond Search
Feature archive
News archive
-
