Could the Google Cloud Secretly Hide Sensitive Information?
April 7, 2021
It is odd seeing Google interested in protecting user information, but Alphabet Inc. follows dollar signs. The high demand for digital security is practically flashing bright neon dollar signs, so it is not surprising Google is investing its talents into security development. Tech Radar shares that simpler applications could lead to better security in the article, “Google Cloud Is Making It Easier For Developers To Smuggle ‘Secrets’ In Their Code.”
A big problem with application development is accidentally exposing sensitive information via the source code. Bad actors can hack applications’ code, then steal the sensitive information. Google Cloud fused its Secret Manager service (a secure method to store private information) with its Cloud Code IDE extensions that speed up cloud-based application development.
The benefits of the merged technologies are:
“The integration allows developers to replace hardcoded data with so-called Secrets, a type of global object available to applications at build or runtime. This way, cloud applications can make use of the sensitive data when needed, but without leaving it exposed in the codebase.
According to Google, the new integration will make it easier for developers to build secure applications, while also avoiding the complexities of securing sensitive data via alternative methods.”
In the past, developers hardcoded sensitive information into their codebase. It made it easier to recall data, but savvy bad actors could access it. Many applications know that hardcoding sensitive information is a security risk, so hey make users run the gambit with authentication services.
Secret Manager and Cloud Code IDE could eliminate the authentication hassle, while protecting sensitive information.
Whitney Grace, April 7, 2021
Microsoft: Your Computer, Your Data. That Is a Good One
March 23, 2021
The online news stream is chock full of information about Microsoft’s swing-for-the-fences PR push for Discord. If you are not familiar with the service, I am not going to explain this conduit for those far more youthful than I. Like GitHub, Discord is going to be an interesting property if the Redmond crowd does the deal. If we anticipate Discord becoming part of the Xbox and Teams family, the alleged censorship of software posted to GitHub will be a glimpse of the content challenges in Microsoft’s future.
The more interesting development is the “real” news story “Microsoft Edge Could Soon Share Browsing Data with Windows 10.” The idea is that a person’s computer and the authorized users of the computing device will become one big, happy data family.
The article states:
Called share browsing data with other Windows features, it is designed to share data from Edge, such as Favorites or visited sites, with other Windows components. Search is a prime target, and highlighted by Microsoft at the time of writing. Basically, what this means is that users who run searches using the built-in search feature may get Edge results as well.
And what does Microsoft get? Possibilities include:
- Federated, fine grained user behavior data
- Click stream data matched to content on the user’s personal computer
- Real-time information flows
- Opportunities to share data with certain entities.
What happens to the user’s computer if said user does not accept such integration? The options range from loss of access to certain data to pro-active interaction to alter the functioning of the user’s computing device.
Why is this such a good idea? Microsoft, like Amazon, Facebook, and Google realize that the days of the Wild West are coming to an end. There are new sheriffs with new ideas about right and wrong.
Thus, get what one can while the gittin’ is good as the old times used to say.
But “What about security and privacy?” you ask? One response is, “That’s a good one.” Why not try stand up?
Stephen E Arnold, March 23, 2021
Dark Patterns: Fool Me Once, Fool Me Twice, Heck Fool Me for Decades
March 18, 2021
I find “dark patterns” interesting. Whether one is used by T-Mobile to make it almost impossible to opt out of the firm’s data slurping and selling biz or the Facebook trick of making “log out” tough to see. There are other, more ingenious methods; for example, if you want to read a super duper white paper, just provide a name and email address. The action flips the switch on spam and scam operations. (Who doesn’t enjoy cybersecurity solutions which cannot detect SolarWinds and Exchange type breaches for three, six, 12 months, or more.
I read “California Bans Dark Patterns That Trick Users into Giving Away Their Personal Data.” The write up reports:
The concept [Dark Patterns] was coined in 2010 but is slowly being addressed in US legislation, with California this week announcing that it is banning the use of dark patterns that stop users from opting out of the sale of their personal data.
The idea of tricking users began a long time ago. The fine P.T. Barnum said:
There’s a sucker born every minute.
How about those free online services?
The article makes clear that regulators are quick to act. Those using dark patterns have to mend their ways in 30 days.
Then what? Let’s use a free online service and free email to share ideas. I have a better idea. Let’s use Clubhouse to discuss options.
Stephen E Arnold, March 18, 2021
Alleged China Data Slurping
March 16, 2021
I spotted an interesting “statistic.” The source was the article “China Harvesting 20% of World’s Data Including from India.” So one-fifth of the world’s data. The write up phrases the assertion this way:
… Approximately 20 per cent of the world’s global population are “being either directly or potentially set up for the Chinese government to collect all of their private data”.
An expert from the cyber security firm Strike Force is quoted as saying:
“If the CCP (Chinese Communist Party) has access to 20 per cent of the data going through the world’s VPNs generally, they should be expected to be using that data for a massive global spying operation that could translate into winning wars, shifting global power, and aiding the rise of an empire,” the expert warned.
If accurate, glib dismissals of TikTok or Zoom links to China may have to be re-evaluated in the shadow of the alleged data slurping.
Stephen E Arnold, March 16, 2021
Search and Privacy: Those Log Files Are Tempting However
March 11, 2021
Search has been a basic Internet function since its inception, but when it was first invented protecting users’ privacy was not a concern. Nowadays a simple search reveals users’ interests, locations, and much more information that can be sold or stolen. TechRadar explains why search needs to be redesigned with privacy as the top priority: “Why We Need To Rebuild Internet Search, Putting User Privacy First.”
Early Internet developers wanted to make money from their new invention in order to build new technology. Investors and developers were happy, because there was a profit. Early Internet advertising, however, transformed into a big privacy problem today:
“Problems later emerged because what started out as a quick fix to a short-term problem turned into a central part of the internet’s architecture. Like anything else in tech, engineers quickly went to work optimizing advertising to be as efficient as possible, stumbling into a situation where the world’s biggest and most powerful companies were suddenly incentivized to gather more and more personal data on users to sell advertising. This resulted in algorithms to maximize engagement on content sites that prioritized instinctive and emotional decisions – or “fast thinking” as the Nobel Prize winner in behavioral economics Daniel Kahneman calls it.”
The information superhighway has turned into a giant consumerism tool that spreads fake news, radicalization, pushes unneeded products and services, and feeds on peoples’ insecurities. Driving sales to stir the economy is one thing, but the spread of misinformation and radicalization leads to dangerous situations, including the recent coup attempt on Washington D.C. and constant backfires against science.
User-experience drives technology design and development, so any new search protocols must have today’s ease of use. Currently multi-party computation (MPC) replicates blockchain-like technology so it protects users’ privacy. Selected computers directly access encrypted data without knowing anything about the data, dubbed zero-knowledge computation.
Zero-knowledge computation is a good solution to protecting user privacy, but there is a big problem preventing more development: money. Advertisers and businesses love the current search system, because it feeds their bottom line. Most users do not protect their data, but if they demanded more privacy protections then organizations would invest more money in that area.
Whitney Grace, March 11, 2021
Sweden: Herring and Privacy
March 10, 2021
Considering all the privacy-related charges European authorities have made against tech companies, we are surprised to learn that “Swedish Authorities Pass On Personal Data of Web Visitors to Google” from the Big News Network. It sounds like the transgressions may not have been intentional. We are told:
“A number of government agencies in Sweden pass on personal data belonging to individuals who visit their websites to Google despite guaranteeing anonymity, local media reported on Thursday. More than 80 government agencies and over 150 authorities pass on personal data in the form of IP addresses belonging to those using their websites without informing them, according to Radio Sweden News. The European Court of Justice has ruled that IP addresses can be used to identify individuals, according to the report. The information is then stored on servers in the United States, making the issue more sensitive as personal data protection is not as strong as within the European Union.”
We are given the example of Statistics Sweden, which had more than 10 million visits last year alone. The agency’s communications director seemed surprised to learn the site has been forwarding IP addresses to Google for over two years. Since Radio Sweden News broke the story, several Swedish agencies and authorities have removed Google Analytics from their websites. Better late than never, we suppose, just like herring nine ways.
Cynthia Murrell, March 10, 2021
Facebook WhatsApp, No Code Ecommerce, and Google: What Could Go Wrong?
March 5, 2021
The Dark Web continues to capture the attention of some individuals. The little secret few pursue is that much of the Dark Web action has shifted to encrypted messaging applications. Even Signal gets coverage in pot boiler novels. Why? Encrypted messaging apps are quite robust convenience stores? Why go to Ikea when one can scoot into a lightweight, mobile app and do “business.” How hard is it to set up a store, make its products like malware or other questionable items available in WhatsApp, and start gathering customers? Not hard at all. In fact, there is a no code wrapper available. With a few mouse clicks, a handful of images, and a product or service to sell, one can be in business. The developer – an outfit called Wati – provides exactly when the enterprising marketer requires. None of that Tor stuff. None of the Amazon police chasing down knock off products from the world’s most prolific manufacturers. New territory, so what could go wrong. If you are interested in using WhatsApp as an ecommerce vehicle, you can point your browser to this Google Workspace Marketplace. You will need both a Google account and a WhatsApp account. Then you can us “a simple and powerful Google Sheet add-on to launch an online store from Google Sheets and take orders on WhatsApp.” How much does this service cost? The developer asserts, “It’s free forever.” There is even a video explaining what one does to become a WhatsApp merchant. Are there legitimate uses for this Google Sheets add on? Sure. Will bad actors give this type of service a whirl? Sure. Will Google police the service? Sure. Will Facebook provide oversight? Sure. That’s a lot of sures. Why not be optimistic? For me, the Wati wrapper is a flashing yellow light that a challenge to law enforcement is moving from the Dark Web to apps which are equally opaque. Progress? Nope.
Stephen E Arnold, March 5, 2021
Another Brilliant Maneuver from the Zuckbook: What Looks Like a Setback Is a Strategic Win
March 1, 2021
I read “Facebook Just Admitted It Has Lost the Battle with Apple over Privacy.” The subtitle suggests that the scintillating managerial acumen is using its custom shibboleth to fool its adversaries at the fruit outfit. Here’s the subtitle illustrating how the Zuckbook is feinting:
The company launched an ad campaign that shows just how worried it is about Apple’s upcoming privacy changes.
Yes, the “real” news outfit Inc. has been fooled. The write up continues:
The company [Facebook] released a pair of ads in three of the most widely-circulated newspapers in the country, accusing Apple of attacking small businesses and the open internet. Mark Zuckerberg also attacked Apple’s motivations during the company’s quarterly earnings report last month, and there are reports that he has been considering filing an antitrust lawsuit against the iPhone maker.
Red herrings have done their job. The dogs of privacy are going in circles. The write up reports:
Now, the company [Facebook] has launched a new campaign, including an ad titled “Good Ideas Deserve to be Found.” The new ad is a little hard to follow but is meant to show the value of personalized ads to small businesses. Facebook wants to make it very clear that personalized ads make for a better experience on Facebook and Instagram, which it also owns.
Confused. Don’t be.
The company [Apple] won’t stop Facebook from tracking you, but it will have to ask you for permission first. Why, then, is Facebook so worried? Because it knows what everyone else already knows–that when given a choice, most people will choose to not allow Facebook to track them.
Such a slick maneuver. Facebook’s moves make Julius Caesar’s tactics at the Battle of Alesia look like the Brazilian president’s Covid fighting campaign. MBAs will study this brilliant Facebook conflict. I am assuming that the MBA programs at certification institutions do more than collect money from the eager students.
Stephen E Arnold, March 1, 2021
Satellites Are Upgraded Peeping Toms
December 28, 2020
Satellites have had powerful cameras for decades. Camera technology for satellites has advanced from being able to read credit card numbers in the early 2000s to peering inside buildings. Futurism shares details about the new (possible) invasion of privacy in: “A New Satellite Can Peer Inside Some Buildings, Day Or Night.”
Capella Space launched a new type of satellite with a new state of the art camera capable of taking clear radar images with precise resolution. It even has the ability to take photos inside buildings, such as airplane hangers. Capella Space assures people that while their satellite does take powerful, high resolution photos it can only “see” through lightweight structures. The new satellite camera cannot penetrate dense buildings, like residential houses and high rises.
The new satellite can also take pictures from space of Earth on either its daytime or nighttime side. Capella also released a new photo imaging platform that allows governments or private customers to request images of anything in the world. Most satellites orbiting the Earth use optical image sensors, which make it hard to take photos when its cloudy. Capella’s new system uses synthetic aperture radar that can peer through cloud cover and night skies.
The resolution for the SAR images is extraordinary:
“Another innovation, he says, is the resolution at which Capella’s satellites can collect imagery. Each pixel in one of the satellite’s images represents a 50-centimeter-by-50-centimeter square, while other SAR satellites on the market can only get down to around five meters. When it comes to actually discerning what you’re looking at from space, that makes a huge difference.
Cityscapes are particularly intriguing. Skyscrapers poke out of the Earth like ghostly, angular mushrooms — and, if you look carefully, you notice that you can see straight through some of them, though the company clarified that this is a visual distortion rather than truly seeing through the structures.”
Capella’s new satellite has a variety of uses. Governments can use it to track enemy armies, while scientists can use it to monitor fragile ecosystems like the Amazon rainforest. Capella has assured the public that its new satellite cannot spy into dense buildings, but if the technology improves maybe it is a possibility? Hopefully bad actors will not use Capella’s new satellite.
Whitney Grace, December 28, 2020
Virtual Private Networks: Not What They Seem
November 17, 2020
Virtual private networks are supposed to provide a user with additional security. There are reports about Apple surfing on this assumption in its Big Sur operating system. For more information, check out “Apple Apps on Big Sur Bypass Firewalls and VPNs — This Is Terrible.” Apple appears to making privacy a key facet of its marketing and may be experiencing one of those slips betwixt cup and lip with regard to this tasty sales Twinkie?
Almost as interesting is the information in “40% of Free VPN Apps Found to Leak Data.” Note that the assertion involves no-charge virtual private networks. The write up reports:
ProPrivacy has researched the top 250 free VPN apps available on Google Play Store and found that 40% failed to adequately protect users privacy.
Okay, security conscious Google and its curated apps on its bulletproof Play store are under the Microscope. The write up points out:
… A study by CSIRO discovered that more than 75% of free VPNs have at least one third-party tracker rooted in their software. These trackers collect information on customers online presence and forward that data to advertising agencies to optimize their ads.
Who is involved in the study? Possible the provider of for fee VPN services like NordVPN.
Marketing and privacy. Like peanut butter and honey.
Stephen E Arnold, November 17, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
