Lab 12 - Keeping it to yourself

We've looked briefly at privacy issues and sharing in Lab 11, as well as some of the earlier labs. One of the challenges of living in a digital, globally networked environment is that the number of ways your personal information can be outside of your control has grown exponentially. Think again about what information is readily accessible to anyone who has your email password, let alone what might be on the laptop your doctor takes home or the servers your bank uses. It isn't possible to exercise control over every aspect of your personal information (or anything else you prefer to or need to keep private).

That lack of control extends to what may be seen as less serious, or at least more beneficial, privacy encroachment. Websites using cookies to deliver a better browsing experience can also collect data about your browsing habits in general. Those sites can deliver target advertisements to you, which you may appreciate. Or you may find it intrusive. Either way, opting out of that data collection often means that you are not getting other site features you do want. And in the case of cell phone companies and data collection, you are not given a choice. Many times, it isn't a question of where do you set your privacy boundaries, but where can you, if you can at all.

Sometimes that control is taken away from you, through compromised security. On a personal level, viruses, malware, phishing schemes and the like can do serious damage. From logging every keystroke (including passwords), to corrupting important files or accessing your bank account information, these malicious applications and social engineering exploits can quickly create big trouble. Getting online through publicly available unsecured wireless access points can multiply opportunities to have your security compromised.

To consider:

Real world examples

In this twelfth lab, we'll look at some specific examples of privacy and security issues. As you explore, review your answers from the To consider: section above. Have you changed your mind about any of them?

Learning more

  1. In 2011, iPhone users got a big and unexpected surprise. Two researchers, Alasdair Allen and Pete Warren, discovered the existence of a file on iOS4 or later iPhones that tracked users' real time locations. They posted an article on O'Reilly Publishing's Radar site: Got an iPhone or 3G iPad? Apple is recording your moves. They also released a free open-source application on GitHub called iPhoneTracker, so any iPhone user who wanted to see their collected information could do so.

    But was Apple alone in tracking location? Android phones also tracked locations, as the Wall Street Journal article Apple, Google Collect User Data makes clear. An Android user wrote a program called android-locdump, which (like iPhoneTracker) gives Android phone users a view into what their phones cache. The code is also free, open-source, and available to download from GitHub. According to Google, however, this location tracking is an opt-in feature and is not turned on by default. Nevertheless, both companies faced class-action lawsuits directly after the news broke.

    • Do you have an iPhone or Android phone? Try these applications. Is your phone still being tracked?
    • What is the benefit to cell phone maufacturers (or cell phone service providers) of keeping historic location data? Would you benefit? Do you think any benefit you might get would be worth it? Why or why not?

  2. Cell phone and tablet applications can learn a great deal about you and your habits. The Android phone and tablet app store, Google Play, currently gives a notice before an app is downloaded to your device that explains exactly what information and hardware the app has access to. At this time, automatic downloading of updates to that app is not selected by default, but can be selected by the user. If the app's access settings change in a future update, the user must approve the update manually, even if the app is otherwise set to update automatically.

    • Why do you think that level of notification doesn't happen in iTunes? Are there big differences in what is allowed in iTunes and what is allowed in Google Play? If so, what are they?
    • Do you think these notifications in Google Play are likely to continue? Why or why not?
    • If you are an Android phone and/or tablet user, do you read those notifications carefully, skim them, or skip them? Have you ever decided not to download an app because of its permission settings?
    • Would you pay more money for an app that was more secure and was less invasive, if you got the same functionality? Why or why not?

  3. In 2012, Google used cookies that bypassed the Safari web browser's privacy settings in order to deliver targeted ads. Users were never prompted to opt-in, and many did not know their privacy settings had been bypassed. Now Bloomberg is reporting the U.S. Federal Trade Commission will be fining Google for the privacy breach. You can read more in the Bloomberg article Google Said to Face Fine by U.S. Over Apple Safari Breach.

    • Take a look at the articles reporting on the breach. Do you think Google did this intentionally, or accidentally? Why?
    • Google has had a long-time reputation for being an ethical company. Do you think that Google has deserved that reputation in the past? And does it deserve that reputation now? Do you think this will affect the number of people who continue to use Google's products? Why or why not?

  4. In 2010, Eric Butler released a free open-source Firefox extension called Firesheep. Firesheep is used on open wireless networks and uses a packet sniffer or analyzer to get unencrypted information stored in cookies on devices accessing those networks, including usernames and passwords. One available countermeasure comes from the Electronic Frontier Foundation - the HTTPS Everywhere plugin, available for Firefox and Chrome browsers.

    • Take a look at some of the documentation around Firesheep. Do you think you are vulnerable to someone using the plugin?
    • Have you already installed or do you plan to install HTTPS Everywhere? Why or why not?
    • In 2014, the Heartbleed Bug surfaced in the news, a vulnerability allowing unauthorized access to personal information like credit card, bank account, and social security numbers, to name a few critical vulnerabilities. Read the Wikipedia entry carefully, and look for other news stories on the issue. Do you feel like the vulnerability has been fixed? What can you do to protect yourself from having your personal information compromised by Heartbleed?
    • There are plenty of additional security add-ons or plugins available for browsers. Mozilla lists them in the Privacy & Security section of their Firefox add-ons site. Chrome doesn't have a special section designated in the Chrome Web Store, but you can find useful lists of popular security related plugins, like this one from makeuseof.com: The Top 8+ Security & Privacy Extensions For The Chrome Browser. Safari browser users can find security-related extensions in the Safari Extensions Gallery. Look for the Security category on the left to select that section.

    Try IT: Installing extensions
    Identify one or more areas of your online privacy and security you think might be improved by installing an extension or extensions, then try installing those extensions.

    • Security-related browser extensions are not immune from security or privacy issues. Did you get prompted to opt-in or opt-out of anything when you installed your extensions? Do you think you have a clear idea of what those extensions have access to?
    • Were the extensions easy to install? If you opted to uninstall them, were they easy to uninstall? Did they uninstall completely? How do you know?
    • While the extensions are installed, are you noticing any differences in your browsing experience? If so, what are they?

Moving on

Keeping your information secure and private can be a challenge. Just when you think you're safe, some new exploit comes along, or something you have no control over gets compromised. One of the best tools to stay protected is to maintain current awareness of risks, but it can be exhausting to try and keep up with all the seemingly constant changes.

Do you think any of these tools that protect you also hinder you? Is there a trade-off between the secure and private versus the open and shared? What kinds of things do you gain or lose by being at one end or the other of that spectrum?