Look before you click - or Phish Spotting

As a public service, I thought I'd provide a little forensic analysis of an incident I experienced yesterday.  The punchline is:  when in doubt about the legitimacy of a web site, try a whois search.

Annapurna was very excited yesterday evening at receiving an email that purported to be from the school of her choice, encouraging her to request admission info from them.

Now, let me say from the start, that I think that said school would be very wise to encourage her to apply,  and I think it not unlikely that it will in time be brought to its senses and will ultimately send her a supplication to grace it with an application and a $50 application fee.

But that may not be what she got yesterday.

No.  This was a college admissions phishing email.  It said,

Based on your achievements thus far, I invite you now to request our viewbook [with a link to...well...you'll hear more about that later],  Within its pages you will discover the countless ways our dynamic campus in [city of School of Choice] can educate, invigorate and inspire you.

Sincerely,

[Real name of Dean]  

Dean of Undergraduate Admissions and Financial Aid 

P.S. We also offer one of the most generous need-based financial aid programs in the country. We received your contact information from the Student Search Service of the College Board. 

Flattering, no?  Who could resist clicking on that magic link?  And if you did, you'd see a page that looked like something the School-of-Choice might put together, complete with school colors, logos, links to legitimate pages at School-of-Choice, etc.

Here's how I got in this story.

I had heard Annapurna going on for a while about the invitation, but I didn't pay much attention.  She's gotten enough legitimate solicitations for applications that in my books this one was no biggie.  It was when she started pestering me about "Should I put your email or Dad's?" that I started to tune in.  I was like, "What?  What do they want MY email for???"  My spam detector was buzzing.

• Dawn's Helpful Hint (DHH) #1:  when a site that already has YOUR email and has already taken the liberty of establishing a relationship with you, they probably don't have any legitimate reason to be asking for anyone else's email address or contact info UNLESS you are in some very, very official process (like an actual college application or providing death benefits information).  Whenever you get a request for someone else's info, your scam detector should go off.  Before you supply the information ALWAYS think very carefully...does this site REALLY need this?  Really?  Why??? And would that person get upset if I gave out their information?

Further investigation showed that the link went to something that looked like it might be related to School-of-Choice, but wasn't quite right.  Let's pretend that the URL for School-of-Choice is http://www.soc.edu.  This thing went to http://www.soc-admin.org.

• DHH #2:  universities almost always use a .edu If you see something purporting to be from a university but doesn't end in .edu...be suspicious. 
• DHH #3:  when in doubt about whether a web page is associated with a large organization like a university or a bank, try to get there from the home page of the organization.  In this case, we went to http://www.soc.edu, and of course the normal admissions pages we got to from there had nothing to do with http://www.soc-admin.org.

And here's the piece de resistance:

• DHH #4: You can always get some pretty interesting information about who really owns the site by performing a WHOIS search.  Network Solutions provides a reasonable one. For example, if you do a whois search on mtsd.us, you will find

• Registrant Name:                             Thomas DeSisto
  Registrant Organization:                     Montgomery Township Board of Education
  Registrant Address1:                         1014 RT. 601
  Registrant City:                             Skillman
  Registrant State/Province:                   NJ
  Registrant Postal Code:                      08558
  Registrant Country:                          United States
  Registrant Country Code:                     US
  Registrant Phone Number:                     +1.6094667182

Looks pretty legit for Montgomery, no?  But when we did that whois search on that soc-admin.org, we found it was registered by one Royall and Company in Virginia. Nowhere near School-of-Choice.  Not surprisingly, when we combed through Annapurna's email for the assorted solicitations she has received over the past few months, many, many of them contained links to websites registered by that very same Royall and Company.  

So why does Royall and Company want to pretend to be assorted gourmet universities?  I don't know.  I'm not Royall and Company.  Their web site indicates that they do direct marketing for student recruitment.  So maybe I'm being too cynical and these universities really have hired Royall to reach out to students who fit some profile or other.  Or maybe they want to sell mom and dad's email address to banks looking to make student loans.  Or both.  I can't tell.  

Total Information Awareness...Take 2

Oy...

Check out this Wall Street Journal (of all sources!) article on how Total Information Awareness is being resuscitated:

The rules now allow the little-known National Counterterrorism Center to examine the government files of U.S. citizens for possible criminal behavior, even if there is no reason to suspect them.

And

The agency's best-known product is a database called TIDE, which stands for the Terrorist Identities Datamart Environment. TIDE contains more than 500,000 identities suspected of terror links. Some names are known or suspected terrorists; others are terrorists' friends and families; still more are people with some loose affiliation to a terrorist.  

Yeah, that means you, you threat to national security peace activists. 

Facebook and Pinterest posts not included.  

Yet.

French Phish

I got my very first phishing email in French this morning.

Bet you can figure it out what it says, even if you don't know French :-)

But spam's such a great way to improve my technical vocab in other languages. What a horrible way to say "user": "utilisateur". It just doesn't roll off the tongue.

No vacation nation

Oh yeah... and while we're at it... another reason it's not so hot being a (working) US mom: not enough vacation time.

CNN has a piece on how lame our national vacation policy is, compared with other "advanced" nations.

Germany is among more than two dozen industrialized countries -- from Australia to Slovenia to Japan -- that require employers to offer four weeks or more of paid vacation to their workers, according to a 2009 study by the human resources consulting company Mercer.

Finland, Brazil and France are the champs, guaranteeing six weeks of time off.

But employers in the United States are not obligated under federal law to offer any paid vacation, so about a quarter of all American workers don't have access to it, government figures show.

That makes the U.S. the only advanced nation in the world that doesn't guarantee its workers annual leave, according to a report titled "No-Vacation Nation" by the Center for Economic and Policy Research, a liberal policy group.

For the record, mandatory (paid) leave is not just good for your mental health. It's a must from a computer security point of view -- it's one tool for detecting fraudulent activities -- the vacationer's backup will be exposed to the vacationer's records and may come across fishy transactions.

NY Times Paywall -- reprise

I did some experiments this afternoon. I'm pretty sure it's cookie-based, as I thought it would be.

'Nuff said.

For what it's worth, I just found Cory Doctorow's analysis/prediction of what the paywall would be, posted on the same day as mine. True to form, he came up with a much darker, deeper, hacker-oriented set of possibilities for how the paywall might work, but makes some of the same points as I did.

New York Times goes paywall

Ok, so the much threatened paywall for the New York Times seems set to go in the US on March 28 (as of today, March 17, in Canada). The gist of it is that "visitors" will get free access to up to 20 articles on line per month, but after that, you will be barred from accessing articles. Except when you access them through Facebook links.

Sulzberger's letter, and the accompanying FAQ is a bit thin on the details. They don't, for example, tell us how they're going enforce that limit of 20 articles per month. I suspect that's because if they did, every script kiddie in the universe, not to mention a fair number of minimally computer-savvy readers would figure out how to circumvent it before it even gets rolled out.

I have some very fundamental questions about the new subscription based service.

Is that limit of 20 person-based? computer-based? IP address based? If it's computer based (i.e. each PC gets access to 20 articles per month), that could mean that I as an individual get access to almost nothing, if I'm sharing the computer with, say, my spouse and kids or roommates. Is that what they really had in mind? If it's individual-based, how are they going to track that I personally accessed 20 this month, without making me log in first? I can't see "visitors" wanting to register for a free account and then logging in just so they can access those 20 articles. I don't think the NYT can see that, either, so I imagine that the tracking mechanism will be minimally invasive, and therefore easy to get around. I'd have to guess it will either be cookie-based (circumvent by deleting cookies?) or IP based (which will have the unpleasant effect of limiting the number of accesses to 20 spread out over all users, but circumventable by going to a different computer -- especially good if using wireless access, I imagine).

Also, does 20 articles mean 20 distinct articles, each of which I can re-read as often as I like? Or does it mean that if I return to re-read the same article 20 times (I sometimes like Paul Krugman or Roger Cohen that much :-), I can't read anything else?

I find it very interesting that they have explicitly excluded links accessed from social media from the 20 articles/month limit. I would have to guess that there is some money flow from Facebook to the NYT -- I'd love to know what the agreement is. But the text of the letter does not provide an exhaustive list of social media sites, which would lead us to believe that it's a blanket policy.

Readers who come to Times articles through links from search, blogs and social media like Facebook and Twitter will be able to read those articles, even if they have reached their monthly reading limit. For some search engines, users will have a daily limit of free links to Times articles.

I just can't believe they'd allow something like that for Joe's Pizza and Social Networking Emporium, without some financial agreement in place. So perhaps it won't hold for some social media sites.

Guess I'd better go catch a leprechaun, to start paying for digital subscriptions!

Checks (and balances) or checks (and bargains)?

Apparently, there are plans afoot to sell off Federal government real estate assets that are not in use.

Sure thing...no problem...we're in the red...raise some cash. Couple of national forests -- who needs them? We can always grow more trees.

However, I was struck by one item in the article:

"This approach will enable us to cut through the red tape and overcome the special interests and parochial politics that have traditionally slowed or halted progress when efforts have been made to reduce government's real estate footprint one asset at a time," the official said.

(emphasis mine).

Now I've seen my share of bad processes, but in my experience, a lot of what is considered "red tape" (i.e. administrative cost and process) is there precisely to put a check on special interests and other bad behavior. Probably the best way to cut red tape, the place you'll really get the biggest bang for your buck in efficiency, is to remove all the scrutiny on the real estate transactions. That's almost certainly where the big administrative costs are. But without the oversight, special interests may have free rein to bully petty government bureaucrats into selling the real estate at just about any price they choose.

In other words, you can cut through red tape OR you can overcome special interests. I question whether you can do both. Well...OK...you probably could do both (given that the oversight processes are sub-optimal). But if I were a betting woman, I'd put money on the cut-red-tape-only solution being implemented. In today's climate.

So no one can say if the internet good or bad, on the whole?

This is a very good interview for people to read and think about.

We hear a lot about how great the internet is for freedom. Evgeny Morozov takes a very balanced view. Namely that the internet is a double-edged sword. Yes, it is used by activists to communicate the abuses and oppressions they are suffering to the world, as well as to coordinate organizing strategies. But it is also used by oppressors to monitor activists and spread disinformation about them and to disseminate propaganda.

Once again we find that computers are fabulous tools to increase productivity. For our side and theirs.

I HIGHLY recommend you read the article.

Netflix and the Death of the DVD?

Netflix has essentially killed Blockbuster, which itself killed the mom-and-pop video store business. And now they're saying "we're going to stop doing DVDs". You will get only online "Watch Instantly" access to movies.

Interesting bait-and-switch.

The first article I read about this was a bit alarmist. It turns out that the switch will happen over a number of years. Apparently Netflix hasn't even peaked, yet, in the DVD space -- that doesn't happen until 2013, according to projections. Nevertheless, I find the predicted shift interesting.

I see a few drivers for the shift away from physical to online:

1. Decrease costs associated with physical management of the DVD media -- mailing costs, storage costs, replacement costs, etc. And it's not just about DVDs, either. Remember videos? 33 1/3 LPs? Tower Records? Who wants to be stuck with the world's largest collection of DVDs, when Gra-ray(tm) comes out?
2. Better control over copyright issues. Personally, I believe this is the main driver. It's easy for customers to copy DVDs, and the RIAA is probably breathing down Netflix's neck about doing stuff to prevent this. With Netflix controlling delivery of the content via the Watch Instantly functionality, they may be able to make it harder to copy movies. I'm not saying they'll be able to control it completely (this is unlikely), but they'll be able to make it hard enough for all but the most determined to make copies, so that from their perspective they'll be making a sizable dent in the "copyright infringement" problem.
3. Better control over your commercial experience. This is probably another big driver. We see this sort of thing already -- when you watch The Daily Show or Colbert Report online, you are not permitted to fast-forward through the commercials, and even more annoyingly, unlike your TV (which you couldn't fast forward either) they are REALLY LOUD, so that you are forced to hear them even if you try to escape them in the bathroom. Netflix will be able to sell this capability to advertisers or sell you premium commercial-reduced service. Great for improving revenue stream either way.
4. Finer-grained customer profiling information. I would have to bet that online viewing offers some interesting data-mining opportunities, including stuff like how often you watch a particular movie, what times of day you watch it, which segments you watch over and over, etc. You know...the kind of stuff that would be great for targeted advertising.

Of course, without physical media, and customers' complete dependence on online providers, it will be interesting to see what happens to prices and diversity/availability of content. But for the reasons I've listed above (and probably others, too) I'd say that the writing is on the wall.

Another conspiracy theory? Or more proof we're too stupid for democracy?

I find it a bit disturbing that the Department of Justice appears to be investigating Rop Gongrijp, among others, on the Wikileaks thing. Specifically, we know that it has subpoenaed Twitter for records about Gonggrijp, as well as Assange, Manning, and Birgitta Jonsdottir (an Icelandic MP), in connection with creation of the video "Collateral Murder".

What disturbs me more about this than I am already disturbed by the whole approach to addressing Wikileaks is that Gongrijp is also one of the main investigators involved in a study that exposed weaknesses in the electronic voting system used in India.

So far, no one has been talking much about the connection, but call me a conspiracy theorist...I have to wonder how much they'll "accidentally" uncover while poking around his stuff. One of the big bones of contention in the India study was that the investigators refused to reveal who was the source of the machine they used in order to test for weaknesses. One very brave scientist, Hari Prasad, was in jail for nearly a week over this issue last August. If the DOJ has subpoenaed email accounts, as well as Twitter access, with as broad wording as the Twitter subpoena, there could be a lot of information in there relevant to the voting machine study, and it could be child's play to accidentally run across the identity of the voting machine source while examining Gongrijp's emails. Once this identity is found it would be simple to (perhaps illegally, but nevertheless surreptitiously) pass the information along to the Indian government.

As of this posting, the only thing we know the DOJ has subpoenaed was Gongrijp's Twitter posts (which seems rather silly, since they're public). We know this because Twitter actually informed him that the request had been made. We don't know what else they may have subpoenaed. And though IANAL, the Twitter subpoena looks rather broad to me...it does not restrict information requested to that relevant to the Wikileaks investigation (which surprises me a bit). It does cover a restricted time period (Nov. 1, 2009 to the date of the subpoena), but this time period also covers the time in which the Indian voting machine study was going on.

If I were the source of the test voting machine, I'd be a little extra nervous, just now. And having him/her punished as a by-product of the Wikileaks investigation would be unfortunate collateral damage, in my opinion.

Beware of reading your wife's email

One man in Michigan could go to jail for 5 years for logging into his wife's email account and reading her messages. He is being charged under a Michigan statute that is intended to protect against identity theft and hacking into corporate systems for the purposes of intellectual property theft.

I'm having a bit of a hard time wrapping my head around this one. IANAL.

Here's the ostensible story: Husband #3 logs in and reads wife's email and figures out (a) that wife is having an affair with abusive ex-Husband #2 and (b) wife's child with ex-Husband #1 is endangered by this. Husband #3 then forwards wife's emails to ex-Husband #1, apparently out of concern for the child.

A few points strike me as possibly relevant, but then IANAL.

1. Mr. Walker (Husband #3) apparently went out of his way to log in to the email account. Would it have been different if his wife had just left her email logged in and he happened to see the messages? I don't know.
2. He claims it was a shared computer. She claims it was hers, only, though he bought it for her. Does this make a difference? I don't know. I tend to doubt it. The email was in a gmail account which could have been accessed just about anywhere in the world.
3. Independent of having read the emails, does forwarding them to a 3rd party make things worse? I don't know. Intuitively, I would say yes. Forwarding them to law enforcement rather than an interested party might have been more justifiable, though I can understand that many people might not want to get on the law enforcement radar, if they believe they can get things settled privately.
4. Did Mr. Walker have independent reason to fear for the child? Had he, in the past, taken any actions to protect the child? This would establish that he was acting in good faith, rather than trying to take some sort of revenge against the wife.
5. In what way is this different from a husband opening physical mail addressed to his wife? Is it a crime to do this? If so, I doubt that it is ever enforced to the extent of a 5 year jail sentence.

If it turns out that there was independent cause to fear for the child's safety, I think that charges against Mr. Walker will probably be dropped. I don't see any judge or jury coming to the conclusion that anything, much less privacy, trumps a child's well-being. In fact, played right by Walker's defense attorney, even if there was no prior fear of harm to the child, simply raising the possibility may be sufficient to get charges dropped.

What disturbs me most about this case is that while Mr. Walker's motives appear admirable (protecting the child), I would hate this to turn into a green light for just anybody to poke around in their spouse's emails at will. I can see abusive spouses monitoring email to micromanage or to find out about plans to combat the abuse. I can see thoughtless spouses forwarding emails to 3rd parties as a humiliating prank. I'm sure they do this, already, but I don't like to give them the legal air cover to do it with impunity. We no longer question the concept of spousal rape, though we may argue over specific instances. I would submit that pawing through a spouse's emails without an invitation to do so can be a violation in many cases.

For the record, I advise never putting anything in email that would do more than make you look silly. Just a suggestion. YMMV.

I love a good conspiracy theory

Ok...so here's a good one.

It seems that slightly over 10 years ago, the FBI may have arranged for some "backdoor" code to facilitate eavesdropping on VPNs (Virtual Private Networks -- things that people use as secure communication lines between computers to prevent eavesdropping) in the OpenBSD operating system, specifically in the implementation of IPSEC. That's right. The FBI apparently wants to be able to eavesdrop on secure communications. And they're willing to sneak the code to do it into widely-used software (think something like Windows).

The allegations come from what ought to be a fairly reliable source: Gregory Perry, the former CTO of NETSEC, a company responsible for some of the OpenBSD development. You would think that such an individual would not make claims like this frivolously. And what makes the situation even more interesting is that the "open" in "OpenBSD" is for open source: the source code (i.e. the computer programs that make up the operating system) is available for scrutiny by essentially anyone in the world. This means that (1) it's in use by a number of organizations because it's free (so there may be a lot of vulnerabilities out there) and (2) lots of folks can be pawing through this code to see if the alleged backdoor code does, indeed, exist.

It is hard to imagine that a backdoor would not have been noticed long before now, given that the code has been freely available for 10 years. This calls into question the validity of the allegations. It is possible, however, that the backdoor was, indeed, discovered some time back, and the offending code removed from earlier versions, attributed to coding errors rather than FBI interference. All of this will be fleshed out as people look through the current version of OpenBSD as well as earlier versions and other operating systems that evolved from OpenBSD.

It is tempting to chalk this up to the Bush-era penchant for secret eavesdropping (aka warrantless wiretaps), but if it turns out to be true, I'm afraid we'll have to lay this one to the credit of another backdoor bad boy. Yes, I'm talking about Bill "Clipper Chip" Clinton.

A good summary of the story is to be found here.

The original email and the announcement to the OpenBSD community can be found here.

And further information provided by Gregory Perry can be found here.

It will be very interesting to see whether Perry's allegations are confirmed over the coming weeks. I don't think it will take long, if they are true.

Edited to add: Declan McCullagh has some good context information here.

Edited to add (12/22): report indicating that head of OpenBSD acknowledges that Netsec may have been paid to create backdoors, but believes that these were never actually released (except possibly in Netsec variants).

Edited to add (12/23): Another report with a bunch of, what I believe is misleading title and text, but with some interesting technical details at the end.

Wikileaks

Now I may have some opinions about whether or not it was a good idea to leak those documents from SIPRNet. But that's not what I want to talk about. No, I want to talk about information security.

Simon Jenkins makes a very nice point on the Huffington Post: The documents taken from SIPRNet were available to "some 2-3 million authorized accessors to the State Department intranet worldwide."

In a pool of 2-3 million accessors, there is guaranteed to be a good sized pool of spies and other individuals who would be...umm...susceptible to assorted temptations and coercions. It boggles the mind that the State Department/Department of Defense would leave the kinds of documents included in the leak out there for just any of those 2-3 million people to read.

Basic IT security includes providing access to information on a Need to Know basis. Did all of those 2-3 million people (or for that matter a Pfc, such as Bradley Manning, putative source of the leaks) really need access to all of that data? In addition, thumb drives and writeable media are a known source of data loss. There is a whole branch of IT security known as Data Loss Prevention (aka Data Leak Prevention) which attempts to address the problem of leaks. In general it's a tough problem, but on the other hand, it's really not rocket science to turn off USB ports and CD writers on computers that can access sensitive data.

I would be willing to bet pretty good money (like a bank account much larger than my own) that many, many of those 250,000 documents to be leaked by Wikileaks were out there long, long ago in the hands of people who weren't intended to see them.

I'm with Jenkins: "Blame the State Department, Not the World's Media" (or Wikileaks).

Macy's "Magic Mirror"

Wow...I just had to ask myself if this wasn't April Fool's Day. I've just seen about the worst idea I've come across in a long time.

"Macy's shoppers can now check their look in a "magic mirror" in a fitting room, thanks to touchscreen computing. A large mirror, linked up to a touchscreen tablet computer, lets visitors to the iconic department store chain's flagship New York location scroll through their options, then digitally "try on" clothes in the mirror. Then they can get quick feedback from friends by posting their image to Facebook or sending it in an e-mail or text.

How long until

1. Someone figures out how to hack the system and turn on the magic mirror remotely, capturing unwitting customers in the fitting room in various stages of undress?
2. (Variant of 1) Someone in the Macy's IT Department figures out a way to run the system in "test mode" to turn on the camera on unwitting customers in the fitting room in various stages of undress...and starts collecting the images?
3. Macy's starts capturing that Facebook or email address you enter, and starts sending you messages like "If you liked that DKNY dress, you'll just love this Ann Taylor"?

Thank goodness it's only scheduled to be available until November.

Edited to add: It all makes sense to me now. It seems that the company that's making this capability available to Macy's is UK-based RetailCam...that would be UK as in the country that brought you Big Brother and 21st century quality surveillance.

Are they playing Pacman with your vote?

Alex Halderman's group managed to get hold of some old Sequoia AVC-Edge voting machines, and without needing to tamper with the tamper-evident seals reprogrammed them to play Pacman.

Sequoia AVC-Edge voting machines are DRE (that's Direct Recording Electronic -- not digital rectal examination, which is perhaps equally pleasant). This means that the only way they capture a vote is electronically: if something goes wrong with the machine, there is no independent evidence of how the voters wished to vote. (This is in contrast with optical scan voting technologies where the voter, for example, fills in a bubble sheet, which is scanned in for ease-of-counting, but which also provides an independent, auditable, debuggable record of the vote.)

Halderman writes,

"The original election software used the psOS+ embedded operating system. We reformatted the memory card to boot DOS instead. (Update: Yes, it can also run Linux.) Challenges included remembering how to write aconfig.sys file and getting software to run without logical block addressing or a math coprocessor. The entire process took three afternoons."

There are three significant points here:

1. It doesn't appear to be terribly technologically difficult to reprogram the machine. I'm sure that having worked out the process in 3 afternoons, it would take them about half an hour to run the same reprogramming process on the next machine.
2. It is possible to do this reprogramming in an undetectable way -- i.e. without messing with the tamper evident seals.
3. Given that the machine is DRE, vote tampering cannot be independently detected or recovered from.

Voting machines are often left on their own in unsecured locations. A motivated attacker in a district that uses these machines could prepare a vote-stealing program in advance, access the machine briefly, and load the program. Without leaving any noticeable evidence. A forensic analysis of the machine would probably detect the program, but without any obvious tampering, who'd bother? And by then, the damage might already have been done -- forensics after election day would detect the possibility of tampering but would not get back what the votes should have been.

I just explained this to Sidharta in about 5 minutes. He totally got it. How come most of our electorate doesn't?

Face Police

Facebook has apparently implemented a "Panic Button" in the UK that "allows youngsters to report suspicious behaviour to the Child Exploitation and Online Protection Centre (CEOP) and Facebook."

I can't help thinking this is a bad idea.

Don't get me wrong. I really don't like the idea of kids being cyberbullied or stalked or in any way endangered in any online forum. And yes, I see lots of potential for all of these via Facebook and other online forums.

But I don't think this Panic Button will ever be terribly useful, and I do think it will cause more harm than good.

Think about it. Do we really want a bunch of 13-18 year olds hitting that button unsupervised, possibly at whim? CEOP, as far as I can tell, is a branch of UK law enforcement. Would you really want law enforcement getting involved with every report a teenager cared to dream up? And can you imagine how much work it would be for law enforcement to sort out all those reports? And who gets blamed when law enforcement can't keep up with it all, and some teenager gets killed anyway? And what happens to the kid who gets reported by some other kid as a prank? Sure it will get sorted out, but how long will it take for that kid to get his life back?

I don't have the answer to handling cyberstalking, but I'm pretty sure this isn't it.

A little taste of the future

Lauren Weinstein called out a proposal last Friday by the White House called National Strategy for Trusted Identities in Cyberspace. I haven't read through it yet, but it's certain to be interesting. I'll post some impressions when I have gone through it. I'm eagerly awaiting commentary by Bruce Schneier and Ed Felten.

This could turn out to be a defining moment for the internet.

What's at issue here is how you are defined as an individual on the internet. How does anybody know you are you? Do they know you're a dog? Sometimes it doesn't matter. Sometimes it does. If you're trying to purchase something online, it seems reasonable for the other party to want to be certain that you are not a mugger who stole your credit card (and for you to want to be certain that you are communicating with a legitimate merchant and not a fake web site). If you're a whistleblower, it seems reasonable for you to wish to hide your identity. If you are a stalker, it seems reasonable for law enforcement to have the capacity to identify you despite pains you may have taken to hide your identity. The ability of the merchant and law enforcement to identify you unambiguously may be in direct opposition to the whistleblower's need for anonymity.

At this point, as I understand it, the proposal claims to be voluntary for "the public". Of course, once the infrastructure is in place, the foot is in the door and it becomes easier to turn it into a legal matter to mandate it for all internet access.

Which is why we should pay attention now.

Bad Mouth Your Boss or Co-worker? How about your employees?

This seems like such a Bad Idea that I'm surprised that Time even bothered to report on it, and that, too, in as neutral a tone as it did.

Essentially, there is a new website, Unvarnished (which I am NOT going to link to) that encourages you to post "anonymous" reviews of your boss or co-workers. Which boils down to anyone reviewing...well...anyone, since there's no possible way for Unvarnished to verify that the person you claim is your boss actually is. (Or, for that matter, that you are who you claim to be, though you are required to identify yourself with a Facebook account.)

The site claims to be an epinions-like way of submitting information about people you work with:

Unvarnished reviews are community-contributed, business-focused assessments of professional performance.

To help reviewers be honest and candid in their reviews, Unvarnished obscures the identity of review authors. This lets reviewers share their true, nuanced opinions without fear of repercussions.

At the same time, to ensure that reviews are of the highest quality, and maintain a helpful, business-focused approach, Unvarnished provides a suite of tools to allow the community to rate and moderate reviews.

How do I hate this? Let me count the ways.

1. Risks to the reviewer:
   How anonymous is this really? To make a review useful, one would have to add enough detail that it would be pretty easy to identify the reviewer. Not to mention clues offered by writing style. Most people "give themselves away every time they open their mouths" (to quote Henry Higgins), even if they think they are posting anonymously. And what's all this business about linking to Facebook? (Actually, to tell you the truth, my guess is the Facebook bit is mostly so that the Unvarnished people don't need to deal with all the adminstrative hassle of managing accounts, but I digress.)
2. Risks to the reviewee:
   What prevents anyone with a grudge about your work from writing any nonsense about your work? Having an argument with your boss/employee/annoying person in another group about whether it is legal to perform some action? Wouldn't go out with someone at work? Wouldn't work an 80 hour week? Do you wear perfume they don't like (and they never had the guts to tell you in person)?
   While we're at it, what prevents anyone in the world from writing any nonsense about your work? Disgruntled neighbors? Annoying ex-boyfriends? Here's one that I bet you wouldn't think of: extortionists. Apparently there's a bit of a cottage industry in Second Life of virtual mobsters gaming the ratings system of unsuspecting users. And that's just Linden Dollars. Think of the USD value you could extract for professional reputation or psychological despair.
3. Risks to the review reader:
   Given the above: can I believe anything I read on this site?
4. Risks to the organization employing the reviewee:
   a) What confidential information may be divulged in a review?
   b) Do you really want your organization's dirty linen aired in front of customers or other parts of the organization?
   c) What does this do to morale within the organization?

Many comments on the article have noted that this is a law suit waiting to happen.

I am half tempted to sign up for access, just to see how much damage you could really do, if you had it in for someone. But I am also paranoid about these sorts of things, especially the bit about hooking it up to a Facebook account. So maybe not.

Interesting summary of security issues

Yes, I know...I'm behind.

I have a long post about my CISSP in production (actually...see below...since I started it earlier, but finished it later, it's the next one down), but in the meantime, I wanted to post an interesting article I saw today. It's about some of the more serious IT threats we are likely to face in the near future. It's chock full of really interesting statistics and anecdotes. It may sound a little technical, but don't worry about the details. I find the bits on insider fraud and social networking particularly interesting.

Enjoy! And sleep tight!

And, as Annapurna might say...MUUUUHAAAHAAAA!!!!!

Wheeee!!!

I'm a CISSP!!!!

For you laypeople...that expands to Certified Information Systems Security Professional.

As I've already mentioned in other fora, several days ago I received the actual piece of paper, complete with gold embossing. Has my name on it, and everything! And I got the lapel pin, too!

What the certification means is that I can now claim to any potential employers or project owners (1) I passed a rather annoying 6 hour exam on ten "domains" (areas) of Information Security and (2) over the course of my career I've had at least 4 years of experience in at least two of those domains (in my case those would be Access Control, Operations Security, Application Security and Information Security and Risk Management) and (3) an existing CISSP vouches for (2) and that I'm of good character and that I'm competent. (Vampire kind of thing going on there. One has to wonder who "made" the first CISSP, but I digress). Surprisingly, having a certificate to these three claims appears to be a requirement for many jobs and participation on many projects.

The exam was truly annoying, and in my opinion, sometimes more an exercise in parsing English carefully than a technical exam. But studying for it was definitely a useful, if somewhat frustrating experience. The exam is "managerial" level (as most training materials will emphasize), also commonly called a mile wide and an inch deep. The content is sometimes poorly defined, contradictory, arbitrary, and focuses on some trivia that is easy to test but almost irrelevant to realistic modern threats (e.g. the infamous Smurf attack -- bet you never thought you'd hear me talking about Smurfs). However, there is some very important content, as well, and the process of thinking about it and organizing it in my mind was, for me, the most valuable part of the experience.

Overall, I'm glad I've got it, but I don't think it changes much what I'm capable of.