Accessible Encryption, Privacy & Security

Sometimes I talk to people about things like privacy, security, or data redundancy and they look at me like I'm a crazy person - why would anyone care about that? Do you have to be some sort of sick weirdo to care that much about those issues?

The reality is that my digital life is pretty boring, but it's important to me. I've had relatives have their emails "hacked" and I can only imagine how much it sucks to lose all of your correspondence and contacts. I've seen stories of people who bring their computers to a shop to have them repaired, and the creeps at Best Buy copy all sorts of personal files to snoop through later. I'm also extremely uncomfortable with the idea of people (internet service providers, governments) monitoring my web browsing habits, just like I'd be uncomfortable reading my physical mail and packages, or looking at my library history, or reading through my medical files.

Here's a few pieces of software that I use to keep myself safe and secure.

KeePass - free - www.keepass.info

One of the worst things you can do online is use the same password EVERYWHERE. If someone breaks into your email account, they can search your history to find all the services you subscribe to (Facebook, your bank, Skype, etc) then try your password on those sites. Odds are in their favour that it will work.

KeePass is a vault where you can store all of your passwords. You set a "master" password on the vault, then save all of your other passwords inside. KeePass also has a password suggester/generator which helps change all of your dumb passwords into awesome passwords. The file is highly encrypted (you generate entropy for the encryption by waving your mouse around the screen) and can't be accessed if you use a complex password. KeePass looks like this:

Generally I have a few unique passwords I remember, like my Gmail account. But everything else goes in the vault, and I randomly generate a 20+ character password for each account. If you asked me what my online banking password was, my honest answer would be "I don't know". I've been using KeePass for over four years and find it indispensable.


TrueCrypt - free - http://www.truecrypt.org/

TrueCrypt is free and open source hard drive encryption software. You can choose to encrypt your whole hard drive, create an encrypted "container" (like a folder) that you can encrypt and decrypt on the fly, or create a secret, undetectable hidden partition. Like KeePass, it uses extremely robust encryption to secure whatever you need away from prying eyes.

What would you store there? Ask yourself this question: If someone stole your computer, do you have any files that you'd never want to be shared with the world? Those are the files you'd encrypt with TrueCrypt. Maybe it's your tax return, maybe it's some bad Grade 8 creative writing that you can't bring yourself to delete, maybe it's your digital diary, who knows.

Or maybe someday you're going to have to cross a border into another country. Border security agents are getting more and more power to do things like copy your entire hard drive onto their systems for analysis. Imagine landing in London only to be immediately deported for having some pirated movies on your laptop. Forget asking whether they might find anything incriminating - do you think your personal data is safe with them?

Just how good is this encryption? Right now, there's a mortgage fraud case in the States where a judge is ordering a defendant to decrypt the contents of her laptop because the Feds can't break it.


Prey - free (for basic version) - http://preyproject.com/

Prey is free (for the basic version) and open source software that helps you recover your computer, phone, or tablet if its stolen. You install the software once, then write down your website username and password somewhere safe (how about your KeePass vault, backed up on your Dropbox account?).

If someone steals your computer and connects to the internet, Prey acts like a "good guy" Trojan horse - you can turn on the webcam, take a picture of the bad guy, and get information about where it's connecting to the internet from (without the thief knowing). You can take that info to your local police and they'll usually step in and get it back. Prey has a whole blog of success stories of people who recovered lost or stolen devices with Prey:
http://preyproject.com/blog/cat/recoveries


A VPN (I use WiTopia, which is $50-70 per year)

I just blog posted about this the other day - go read this post: http://blog.brahm.ca/2012/02/virtual-private-networks-and-why-you.html


Tor Browser - free - http://www.torproject.org

In my blog post about VPNs I give an over-simplified explanation of how VPNs work. Tor is a network of VPNs that obfuscates your location by encrypting your web traffic and routing it through multiple "Tor nodes" all over the globe. A super-detailed explanation can be found here.

I first heard about the Tor project a few years ago, when it was significantly less user friendly - it required a lot of end-user configuration. I just checked it out today, and wow, I'm impressed. It can be downloaded as a pre-configured instance of Firefox's portable edition that "just works". You start it up, wait a second as it builds an encrypted connection, and this is what you see:

If you're trying to access the internet from a country with a crazy dictator or want to take the simplest step possible to protect your privacy when you're travelling, install Tor Browser. Here's a list of who uses it, and why.

--

Make yourself and your data safe, and protect yourself from digital snoops!

Virtual Private Networks and Why You Might Want One

On Tuesday I signed up for a paid Virtual Private Network (VPN) service. Why? In three words: privacy, security, and flexibility.

The internet is not a series of tubes as you may have been led to believe. It is a network of computers that all have to talk to each other. Sometimes it is not clear who owns what computer, if they are using it for good or for evil, or if it can access your private data.

Here's a simplification of how the internet works. Let's say you want to visit Wikipedia, so you type http://en.wikipedia.org into your browser. Your network traffic (requests you send to the internet, and the data that comes back) first passes through your local network. This is literally the network you're connected to - a router at home, a wifi hotspot at Starbucks, or maybe a computer lab on campus.

Next, the traffic passes through your Internet Service Provider's servers: SaskTel, Shaw, Rogers, etc. Finally, your traffic passes through more servers until it gets to Wikipedia's servers. Wikipedia's servers then sends information back to you the same way you received it. Anyone who is determined enough can snoop at what you're looking at - maybe someone sitting at the other side of Starbucks, or maybe someone who works at Shaw, or maybe some tricky hacker.

A VPN creates a highly encrypted and secure connection (a "tunnel") between your computer and a VPN server. If you type http://en.wikipedia.org into your browser when you're using a VPN, the VPN server "asks" Wikipedia for the info you wanted, then sends it on to you. Wikipedia won't know anything about you (unless you're logged into a user account) and it cannot tell you're using a VPN, and no-one between the VPN server and your computer can see what's going on, either.

Here's a diagram I made (all by myself!) that explains how VPN works. Click to enlarge:

It is virtually impossible for anyone between your computer and the VPN server to figure out what you're doing on the internet - whether it's paying your bills, submitting your tax return, typing a note to your sweetie, learning about dogs and cats, or watching a saucytime grownup film.

Privacy and security are good enough reasons to get a VPN - I'm confident that data I'm transmitting on my computer can't be intercepted by local hackers, my Internet Service Provider, the government, or whoever might be "listening" to internet traffic. But the coolest feature - at least for Canadians - is flexibility.

Lots of websites know roughly where you're browsing from, based on your IP addresses. It's why when you type "www.google.com" you're taken to www.google.ca. It's why Canadians can't watch lots of streaming videos, due to dumb licensing rules.

But with my VPN provider, I can pick a VPN server anywhere in the world, so my traffic looks like it's coming from anywhere in the world. I can pick a server in New York City and immediately start watching videos on ComedyCentral or Hulu (or others). Or I can pick a server in the UK and start watching BBC content.

I selected WiTopia.net as my VPN provider. They are very well-reviewed, and in my limited experience - great. They responded to a bunch of pre-purchase questions quickly and with lots of details. There are some free VPN providers out there, but it's easy enough for a 16-year-old hacker to set up a VPN server and make it look legit - so I'm paying for peace of mind. With WiTopia, you can pay by the day, month, or year, and there are lots of money-back guarantees. So check them out if you want to protect your online info and free yourself from the shackles of location-based internet!

Blog post: done. Now I'm off to watch full episodes of the Colbert Report!

Canadian Toilets

I remembered something that happened on me and Robyn's Disneyworld trip.

I approached a Cast Member (what Disney employees are called) and asked, "Where is the nearest washroom?"

She gave me a puzzled look and said, "You mean... ... for clothes?"

I said "No, I mean a bathroom." She pointed me in the right direction.

According to Wikipedia, it turns out that only Canadians use "washroom" to describe public toilets. To Americans, a washroom is a laundry or utility room, and public toilets are called bathrooms or restrooms.

In my mind, bathrooms can only be in homes, because most public toilets don't have bath tubs. Restroom just doesn't seem like the right word to describe a public toilet - I try to be in and out, not hang around to rest.

And asking for a toilet just seems rude.

No Facebooking Allowed on Election Night

Section 329 of the Canada Elections Act - written in the 1930s - prohibits the premature broadcasting of election results over Canada's many time zones. Elections Canada recently came out and said that this law applies to the private Facebook posts and tweets of ordinary citizens.

 

Broadcasters have played by these rules for 80 years, but it's pretty ridiculous and more-or-less unenforcable to levy the same law against internet users in 2011. I feel like Elections Canada is ashamed of this law; in one radio interview one of their representatives said something like, "we didn't write this law but it is our obligation to enforce it" (sorry, I can't provide a citation).

 

On today's episode of Q with Jian Ghomeshi, Paula Simons of the Edmonton Journal raised an interesting point - she said that as a member of the news media she is not willing to risk incurring a $25k fine by posting election results in advance. She will, however, be scouring the 'net and reading what other people post out of sheer curiosity.

 

This got me thinking about some of the more silly nuances of how this law is interpreted:

• If it's illegal to post election results in advance on Facebook, is it illegal to "Like" or comment on someone's status that contains advance election results, if that causes the original comment and your action to be re-published in your friends' feed?
• Is it illegal to "Re-Tweet" a tweet containing advance election results, which effectively broadcasts the message to a new group of users?
• Is it illegal to link to a source of offending information in your Twitter posts or Facebook wall?

It would be too easy to sign up for a new, anonymous Twitter account through a proxy server and tweet election results anonymously to your heart's content. Actually, I am willing to bet a good number of people who find this law ridiculous plan to do just that. This article talks about a "cyber rebellion" in the works.

Martin Luther King once said, "Just as it is the duty of all men to obey just laws, so it is the duty of all men to disobey unjust laws". 

 

Thankfully, the CBC and Bell Canada (CTV) have teamed up and have challenged the law in the Supreme Court of Canada (source), but it was not possible to rush the decision to before the election.

 

Is anyone else going to be refreshing Twitter all night on Monday?

 

Related: Here's a good blog providing aggregate analysis of election polls if you're digging this election: http://www.threehundredeight.blogspot.com/

 

GREAT Customer Service from Air Canada!

Believe it or not! Read on to find out...

On my first visit back to Saskatoon from Montreal, Air Canada let a connecting flight in Toronto leave without me. Some details here. Every flight from Toronto to Saskatoon was full and it was looking like I would be spending the night, so when I heard a boarding call to Regina I ran to the gate and got on that plane with seconds to spare. Robyn picked me up from Regina - how nice!

The catch: because I didn't talk to Customer Service in the Toronto airport, I was told I wouldn't receive any compensation for the inconvenience (that gate agent who got me to Regina was great, though - she was just telling it like she saw it).

I wrote Air Canada's Customer Relations department a letter where I explained the timing of the whole situation, provided my confirmation numbers, and requested compensation. The last two paragraphs looked like this:

To summarize, my desire to get home and spend time with family and friends caused me to miss being compensated by Customer Service for the missed connection, and caused my (patient, loving) girlfriend to incur a 500km round-trip to pick me up in her vehicle. I am requesting a $200 travel voucher from Air Canada to fix this inconvenience.  

Considering I avoided a night in a hotel at Air Canada’s expense, and considering the costs of gas and mileage on my girlfriend’s vehicle, I believe this figure is fair. If that’s not enough, this show of good faith from Customer Relations would guarantee Air Canada gets my business over WestJet for the next year’s worth of Montreal-to-Saskatoon round trips (13 in all, or about $8,450 with today’s prices), and guarantee a positive recommendation to friends, family, and colleagues. 

Without prejudice,
Brahm Neufeld

Well lo and behold! I got an email today that read:

Dear Mr. Neufeld,
Thank you for taking the time to contact our office. 

I sincerely regret to learn of the difficulties you experienced while travelling to Saskatoon on February 25, 2011 and on behalf of Air Canada, offer our most sincere apologies. 

As a gesture of goodwill and in recognition of your valued support, I have taken the liberty of issuing a future travel credit in the amount of $200.00 CAD.  

.... {details of the travel credit} 

We look forward to serving you again under less extenuating circumstances. It will be our privilege to welcome you on board. 

Sincerely,
{redacted}
Customer Relations

So there you have it - an excellent resolution!

Truthfully, I didn't know whether my letter would have any effect - I've never asked for anything like this. But Air Canada came through, surprised me with a very clear apology and exactly the compensation I asked for.

And I'll hold up my end of the bargain - I'll be flying Air Canada the rest of the year, wherever possible. Errr... except the two trips I already have booked on WestJet.

Twitscape

One cool thing about Twitter is that you're one "submit" button press away from connecting with a company or a celebrity!

Today I sent a message to the host of CBC Radio's Q, Jian Ghomeshi, and received a near-immediate response:

*swoon*

How cool is that?! It's like a digital autograph.

One funny thing about Twitter is that, because every tweet is more or less public, companies can search for mentions of themselves and immediately send responses.

When a contact asked where she could grab a specific computer accessory, I recommended two local Saskatoon shops and London Drugs. I have a running theory that London Drugs always, always, always has what I want, sometimes even before I know I want it. One Christmas, Robyn and I checked 7 stores for Candy Cane Lane Tea, and we were about to give up, but I knew we'd find it because we hadn't checked London Drugs yet. We bought a dozen boxes.

Anyway, when I tweeted that London Drugs always has what I want, they responded, "we try!"

It's a cool feeling to directly connect with a company, too!

Finally, in 2009 I posted about my excitement for an upcoming Sloan concert, and the band retweeted (think: re-posted) my comments in their feed to all of their fans:

--

More posts coming this week! Robyn came for a visit this past weekend and we have some neat pictures. And next Sunday I think I am going to check out Montreal's St. Patrick's Day Parade, which has been around for over 150 years!

Canadian Privacy Commissioner's Google Street View Probe: Let's Drop It

On Friday, May 14, 2010, Google announced that their camera-laden Street View cars had been inadvertently been collecting unencrypted wifi data:

"...we have been mistakenly collecting samples of payload data from open (i.e. non-password-protected) WiFi networks, even though we never used that data in any Google products." (source: Google)

I recommend reading Google's entire explanation for an example of a perfect admission of wrongdoing and accompanying apology. Straight out of the good communication textbook, Google:

1. Acknowledged their wrongdoing (collection of unsecured wifi data);
2. Recognized feelings of anger, frustration, disappointment and betrayal;
3. Took full responsibility for their actions;
4. Explained their error without assigning blame;
5. Offered a sincere apology;
6. Offered an immediate fix for the problem (grounding of all Street View cars, contacting government regulators about how to dispose of the data).

In response, Canada's Office of the Privacy Commissioner is launching a full investigation into what happened (see link for news release).

Says Privacy Commissioner Jennifer Stoddart:

“We have a number of questions about how this collection could have happened and about the impact on people’s privacy. We’ve determined that an investigation is the best way to find the answers.”

But... don't we already have the answers? Google collects data, Google realizes mistake, Google releases details of exactly what happened and how, Google gets in touch with governments so they can delete this data properly. And because Google collected the data and not evil hackers, guess what the impact was: nothing.

I like the Office of the Privacy Commissioner. They're a taxpayer-funded office who promote and protect the individual privacy rights of Canadians - and I'm down with that. They've slapped Facebook into shape on more than one occasion. But do we need to be spending taxpayer dollars on an investigation where there isn't anything to investigate?

Canada isn't the only country getting up in arms. The Consumerist is reporting that 30 American states are banding together for an investigation of their own. 

Here's the real issue. The data in question that was collected by Google was pulled off unsecured wireless networks. In layman's terms, that's a network without a password and encryption. People were (in all fairness, unknowingly) broadcasting their internet interactions for the world to see. Yes, that includes emails and passwords!

Forget about Google, what about Wardriving? There are far less-responsible people and organizations than Google who are pulling information from unsecured networks all of the time. Suddenly, the fact that Google's sitting on information from our private networks is awesome - now that they have it, they can protect it, they know they have to get rid of it, and they can't use it maliciously. And they're good at security. When Chinese hackers hacked Google, Google hacked them back.

The Office of the Privacy Commissioner should be helping Canadians by lowering the number of people who are accessing the internet over unsecured networks. They should be developing ways to make sure products like routers and laptops are safe (privacy-wise) to use out of the box, and to promote the use of secure protocols to websites that handle sensitive information (banks, social networks, email, etc). They should be finding ways to better educate the public on taking privacy matters into their own hands. They should be working with Google to dispose of that private data as quickly as possible, rather than work against them through an investigation. They should be developing programs so that everyone can understand privacy and data in the digital age.

Forget about this investigation. It should be the end-user's responsibility to take steps to protect their own privacy. No user is perfect - I've helped lots of people with different computer issues, and I've made plenty of mistakes myself. No hardware is perfect - many wireless routers are "broken" out of the box, in that their out-of-box settings are terribly insecure. Lastly, no software is perfect - Google's Street View cars were obviously flawed.

Still, individuals must accept a higher degree of responsibility for their digital privacy and security. Nobody would paint their SIN number on the side of their house, yet there are plenty of unsecured wireless networks doing just that.

The Internet Beyond Facebook

I deleted my Facebook account just before it was "cool" - at the end of April 2010. See? This is the Google Search Trends for the query "delete Facebook":

It was just after I read the Eroding Privacy Timeline, published by the Electronic Frontier Foundation, and right before these events happened:

1. May 5 - Facebook Security Hole Exposes Private FB Chats and Friend Lists to All
2. May 6 - Instant Personalization Adds Malware to FB Profiles
3. May 7 - Facebook Leaks IP Addresses of Users
4. May 11 - Shameful New York Times Interview With Facebook Exec
5. May 17 - OpenBook is released (not by Facebook), which lets you search Facebook's newly-public updates for people who are publicly announcing that they hate their boss, are using drugs, and are having sex (etc).
6. May 21 - "Anonymous" User/Ad Data Found Not Anonymous

Yes, May 2010 was a bad month for Facebook and I am glad I got out when I did (not that my account was actually deleted).

Here's a fair question of me: If I care so much about online privacy issues, why do I have a blog, a homepage, a Google/Gmail account, a Twitter account, etc?

For one, most of the online services I subscribe to have fairly easy-to-read and easy-to-digest privacy policies (example: Gmail. Counterexample: Facebook's privacy policies over time). Second, my favourite services often give me an easy way out - it's easy to delete accounts, unlike Facebook. Third, most of these services have spent a lot of time building and earning my trust as a user - Facebook has always been sketchy. Fourth, and perhaps most importantly, the services don't radically change over time, at least not to the insane degree that Facebook has changed from privacy-centric to advertiser-centric.

(I'll admit that the services I like aren't without flaws. I am a fan of Google products but they dropped the ball with Google Buzz when it was released).

There's a difference between leading a private life and the expectation of the right to privacy. For example, from Fall 2008 to Spring 2009 I spent months trying to get more information on the secret yellow tracking dots that colour laser printers use to identify document owners (it's not a conspiracy theory!). I got in touch with Lexmark and they eventually offered to give me a full refund on my years-old colour laser printer, but I was more concerned with the overall privacy issue at hand, not my personal privacy. I declined the offer.

Back on topic. Privacy issues aside, Facebook had evolved into a service that just wasted my time. I'd log in (several times per day, usually) and just creep updates. Then, I realized that the reasons most people used Facebook suddenly no longer applied to me!

• Photo sharing - Facebook does this well, but there are free alternatives with more flexible privacy controls like Flickr and Google's Picasa.
  
  
• Staying in touch with friends and family - That's why I have a phone (voice/text/BlackBerry Messenger) and email.
  
  
• Reconnecting with old friends - There are lots of other ways to do this.
  
  
• Connecting with organizations through Fan Pages - Often congested and ugly for big organizations and under-used and neglected for small ones. Also, this feature is now less about connecting and more about marketing.

I'm not arguing that everyone should delete their Facebook account; I am arguing no-one should feel trapped by something they optionally use. If you feel trapped, it's a sign you need to escape.

I felt cut off for the first few days after deleting my Facebook account, but now that it's gone, I don't feel like I am missing anything - I can waste my time doing other things! My subconscious urge to constantly check it is gone - I've escaped from the trap!