Privacy

A Google Privacy Stumble

by

If you use Gmail you may have noticed a new feature called “Buzz”, which is Google’s attempt to create something like Facebook.

Email and Facebook-type social networking services are different in function and in their users’ privacy expectations. Google erred by 1) assuming that users of email, the less intrusive service, would want to be signed up by default for the more intrusive social networking service, and 2) configuring the privacy settings of the social networking service in a way that can casually expose a user’s private information before the user has a chance, or even knows, to change the relevant settings.

Here is an example of the kinds of problems Google’s new scheme caused.

Here are instructions for restoring the (relative) privacy of your Google account.

Google will probably correct its blunder soon if it hasn’t already. But it’s interesting that they blundered in this way in the first place. They showed a Microsoftian level of cluelessness about privacy and security. It’s as if the Google offices were a monoculture of young computer geeks for whom clever new features are first and foremost cool toys with business upside and no downside, rather than complex systems that sometimes interact in unexpected ways and may have the potential to harm people who have something to lose. Oh, wait…

Google’s “don’t be evil” motto, always a cynical joke, deserves at least as much ridicule as does the DHS terror-threat color code. People in China learned this some time ago.

Don’t be stupid. Don’t trust Google or other free Web-service providers with information that you can’t afford to make public.

UPDATE: An attorney offers scathing and insightful critique of Google here and here. The second linked post gives additional advice on deactivating your Buzz account, including a link to Google’s own instructions for doing this.

Penumbra Obliterated

by

I’ve got a question for any of our readers that happen to be lawyers.

Free access to abortion services appears to be a shibboleth of the Left that they hold particularly dear. That, at least, is the unmistakable conclusion one must draw when considering the actions of the Democrats.

For example, the abortion question was at the forefront of the news all during the Bush administration. Just about every time the President nominated a jurist to fill a vacancy on a court bench, it seems that the Democrats wanted to spend most of their time during the confirmation hearings endlessly grilling the potential judge on their views concerning abortion. If memory serves, it started with Priscilla Owen, who had to wait through four years of wrangling and filibuster before her nomination ever came to a vote! In fact, she would probably still be stuck in confirmation hearing limbo if it wasn’t for the so-called Gang of 14.

There were other issues that got the Dem’s fur up, but it seemed to me that the abortion issue certainly took center stage more often than any other.

Read more

Quote of the Day

by

We’ve been assured again and again that RFID passports are secure. When researcher Lukas Grunwald successfully cloned one last year at DefCon, industry experts told us there was little risk. This year, Grunwald revealed that he could use a cloned passport chip to sabotage passport readers. Government officials are again downplaying the significance of this result, although Grunwald speculates that this or another similar vulnerability could be used to take over passport readers and force them to accept fraudulent passports. Anyone care to guess who’s more likely to be right?
 
It’s all backward. Insecurity is the norm. If any system — whether a voting machine, operating system, database, badge-entry system, RFID passport system, etc. — is ever built completely vulnerability-free, it’ll be the first time in the history of mankind. It’s not a good bet.
 
Once you stop thinking about security backward, you immediately understand why the current software security paradigm of patching doesn’t make us any more secure. If vulnerabilities are so common, finding a few doesn’t materially reduce the quantity remaining. A system with 100 patched vulnerabilities isn’t more secure than a system with 10, nor is it less secure. A patched buffer overflow doesn’t mean that there’s one less way attackers can get into your system; it means that your design process was so lousy that it permitted buffer overflows, and there are probably thousands more lurking in your code.
 
Diebold Election Systems has patched a certain vulnerability in its voting-machine software twice, and each patch contained another vulnerability. Don’t tell me it’s my job to find another vulnerability in the third patch; it’s Diebold’s job to convince me it has finally learned how to patch vulnerabilities properly.

–Bruce Schneier

Your Papers Please: The Real ID Act

by

National ID cards have been an on again/off again controversy in this country, engendering huge opposition whenever they were proposed. Now, however, thanks to recent appropriations legislation into which a national-ID provision was inserted without many people noticing, and which passed easily, a national ID card may be a done deal. The legislation that enables it is the Real ID Act and has already been discussed extensively. Nonetheless it deserves all the scrutiny it can get.

Info on Real ID:
–Read the bill: Enter “hr 1268” in the search window, select “Enter bill number” and click “Search”; then click on the link for Version 3 of the bill, and search for: “TITLE II–IMPROVED SECURITY FOR DRIVERS’ LICENSES AND PERSONAL IDENTIFICATION CARDS”.
–Wired article
-Instapundit has link-filled posts here and here.
-Jews For The Preservation of Firearms Ownership raise troubling questions about the Real ID Act as it pertains to gun ownership.

Maybe the concern about this law is overwrought. I don’t know. I do know that it is unlikely to improve our security (see Bruce Schneier’s lucid critique here) but is very likely to reduce our freedoms. It’s also a distraction from implementation of more-effective security measures. It was passed almost surreptitiously, and as it seems to have been designed mainly as a tool against illegal immigration it may be that little consideration was given to concerns about privacy and freedom. That’s the way it looks, anyway. None of this bodes well.

(JPFO link via our friends at the Revolutionary War Veterans Association)