Lab 12 - Keeping it to yourself
We've looked briefly at privacy issues and sharing in Lab 11,
as well as some of the earlier labs. One of the challenges of living in a digital,
globally networked environment is that the number of ways your personal information
can be outside of your control has grown exponentially. Think again about what information
is readily accessible to anyone who has your email password, let alone what might be
on the laptop your doctor takes home or the servers your bank uses. It isn't
possible to exercise control over every aspect of your personal information (or anything
else you prefer to or need to keep private).
That lack of control extends to what may be seen as less serious, or at least
more beneficial, privacy encroachment. Websites using cookies to deliver a better
browsing experience can also collect data about your browsing habits in general.
Those sites can deliver target advertisements to you, which you may appreciate. Or
you may find it intrusive. Either way, opting out of that data collection often means that
you are not getting other site features you do want. And in the case of cell phone
companies and data collection, you are not given a choice. Many times, it isn't a
question of where do you set your privacy boundaries, but where can you, if you can at all.
Sometimes that control is taken away from you, through compromised security.
On a personal level, viruses, malware, phishing schemes and the like can do serious damage.
From logging every keystroke (including passwords), to corrupting important
files or accessing your bank account information, these malicious applications and
social engineering exploits can quickly create big trouble. Getting online through
publicly available unsecured wireless access points can multiply opportunities to
have your security compromised.
To consider:
- One of the most significant consequences of compromised privacy is identity
theft. Do you already take measures to prevent it happening to you? What do you
do?
- Take your own quick digital security inventory. Do you feel like you are taking
appropriate measures to protect yourself and your information? Explain.
Real world examples
In this twelfth lab, we'll look at some specific examples of privacy and security
issues. As you explore, review your answers from the To consider:
section above. Have you changed your mind about any of them?
Learning more
In 2011, iPhone users got a big and unexpected surprise. Two researchers,
Alasdair Allen and Pete Warren, discovered the existence of a file on iOS4 or
later iPhones that tracked users' real time locations. They posted an article on
O'Reilly Publishing's Radar site:
Got an iPhone or 3G iPad? Apple is recording your moves. They
also released
a free open-source application on GitHub called iPhoneTracker,
so any iPhone user who wanted to see their collected information could do so.
But was Apple alone in tracking location? Android phones also tracked locations,
as the Wall Street Journal article
Apple, Google Collect User Data makes clear. An Android user
wrote a program called
android-locdump, which (like iPhoneTracker) gives Android phone users
a view into what their phones cache. The code is also free, open-source, and available to
download from GitHub. According to Google, however, this location tracking is
an opt-in feature and is not turned on by default. Nevertheless,
both companies faced class-action lawsuits directly after the news broke.
- Do you have an iPhone or Android phone? Try these applications. Is
your phone still being tracked?
- What is the benefit to cell phone maufacturers (or cell phone service
providers) of keeping historic location data? Would you benefit? Do you
think any benefit you might get would be worth it? Why or why not?
- Cell phone and tablet applications can learn a great deal about you and your habits.
The Android phone and tablet app store, Google Play, currently gives a notice before an app is
downloaded to your device that explains exactly what information and hardware
the app has access to. At this time, automatic downloading of updates to that app
is not selected by default, but can be selected by the user. If the app's access
settings change in a future update, the user must approve the update manually,
even if the app is otherwise set to update automatically.
- Why do you think that level of notification doesn't happen in iTunes?
Are there big differences in what is allowed in iTunes and what is allowed in
Google Play? If so, what are they?
- Do you think these notifications in Google Play are likely to continue?
Why or why not?
- If you are an Android phone and/or tablet user, do you read those notifications carefully,
skim them, or skip them? Have you ever decided not to download an app because of
its permission settings?
- Would you pay more money for an app that was more secure and was less
invasive, if you got the same functionality? Why or why not?
- In 2012, Google used cookies that bypassed the Safari web browser's privacy
settings in order to deliver targeted ads. Users were never prompted to opt-in,
and many did not know their privacy settings had been bypassed. Now Bloomberg
is reporting the U.S. Federal Trade Commission will be fining Google for
the privacy breach. You can read more in the Bloomberg article
Google Said to Face Fine by U.S. Over Apple Safari Breach.
- Take a look at the articles reporting on the breach. Do you think
Google did this intentionally, or accidentally? Why?
- Google has had a long-time reputation for being an ethical company.
Do you think that Google has deserved that reputation in the past? And does it
deserve that reputation now? Do you think this will affect the number of
people who continue to use Google's products? Why or why not?
- In 2010, Eric Butler released a free open-source Firefox extension called
Firesheep. Firesheep
is used on open wireless networks and uses a
packet sniffer or analyzer to get unencrypted information
stored in cookies on devices accessing those networks, including usernames and passwords.
One available countermeasure comes from the
Electronic Frontier Foundation -
the HTTPS Everywhere plugin, available for Firefox
and Chrome browsers.
- Take a look at some of the documentation around Firesheep. Do you think you
are vulnerable to someone using the plugin?
- Have you already installed or do you plan to install HTTPS Everywhere?
Why or why not?
- In 2014, the Heartbleed Bug
surfaced in the news, a vulnerability allowing unauthorized access to personal information like
credit card, bank account, and social security numbers, to name a few critical
vulnerabilities. Read the Wikipedia entry carefully, and look for other
news stories on the issue. Do you feel like the vulnerability has been
fixed? What can you do to protect yourself from
having your personal information compromised by Heartbleed?
- There are plenty of additional security add-ons or plugins available for browsers.
Mozilla lists them in the
Privacy & Security section of their Firefox add-ons site.
Chrome doesn't have a special section designated in the
Chrome Web Store, but you can find useful lists of popular security related plugins,
like this one from makeuseof.com:
The Top 8+ Security & Privacy Extensions For The Chrome Browser.
Safari browser users can find security-related extensions in the
Safari Extensions Gallery. Look for the Security
category on the left to select that section.
Try IT: Installing extensions
Identify one or more areas of your online privacy and security you think might be
improved by installing an extension or extensions, then try installing those extensions.
- Security-related browser extensions are not immune from security or privacy issues.
Did you get prompted to opt-in or opt-out of anything when you installed your extensions?
Do you think you have a clear idea of what those extensions have access to?
- Were the extensions easy to install? If you opted to uninstall them,
were they easy to uninstall? Did they uninstall completely? How do you know?
- While the extensions are installed, are you noticing any differences
in your browsing experience? If so, what are they?
Moving on
Keeping your information secure and private can be a challenge. Just when you
think you're safe, some new exploit comes along, or something you have no control
over gets compromised. One of the best tools to stay protected is to maintain current awareness of
risks, but it can be exhausting to try and keep up with all the seemingly constant changes.
Do you think any of these tools that protect you also hinder you? Is there a trade-off
between the secure and private versus the open and shared? What kinds of things do
you gain or lose by being at one end or the other of that spectrum?