Bookmark and Share

January 18, 2012

Should Congress Censor the Web?

I personally do not know a lot about the upcoming vote and how exactly a yes vote will censor the internet.  For those that of you that may be wondering what I’m referring to, I’m referring to the SOPA and the PROTECT IP Act.  Congress will be voting on these acts January 24th.  From what I understand the acts are suppose to help fight piracy on the internet.  However, there are many businesses that feel this will hinder the thrive the internet gives their business.  Want to see examples?  Just check out www.google.com or www.firefox.com.  They currently have voiced their opinion on the issue on their main page.

If what Firefox and Google reports is accurate, the US government will have unprecedented control over the internet (both within and outside the country).  Firefox and Google feels this will hinder our freedom of speech on the internet.  But that in of itself brings up an interesting question.  When the freedom of speech was put into the constitution, the internet did not exist.  Should the internet receive the same freedom as our verbal speech is?  Is our written word any different than our typed word?  As far as I know the press still falls under the freedom of speech, so why should the internet be any different?  Those who think our government is becoming more of a socialist minded government will definitely see that in this move.  Why do I say that?  The same censorship the US Government wants to put into place is currently used by China, Iran, and Syria.  

Feel free to comment below.  If this is not now, it will be a hot topic.

December 22, 2011

How young is too young when talking about cellphones?

I’m guessing I’m a little more conservative than the average person on this subject, but I think it’s better to wait as long as possible before giving your child a cellphone.

While I recognize that it can be a nice convenience for busy parents and families with hectic schedules, I think it also can turn into a huge distraction for kids and it opens a whole can of worms in terms of social interaction for children at a time when they may not need to be connected every moment to their peers (just watch adults and how they interact on their phones).

In particular, I am not a fan of elementary or middle school age children having their own cellphones, and I’ll touch on that later. Many people, me included, think that the idea of a high school student owning a phone can be a good idea. “When you give your child a cellphone you are giving him or her a lot more freedom and access to a social life that can’t be supervised,” said Marybeth Hicks, editor of Family Events, a newsletter for families and moms, which I recommend if you have children, and author of two books on parenting. “A lot of parents are blindsided by some things that come up as a result of kids using cell phones, and the truth is they are the ones providing that access.”

Hicks, who has four children, said she recommends that kids get their first cellphone in high school.

“Getting a cellphone is a rite of passage in our house,” she said. “It’s something my kids get in the summer between eighth grade and their freshman year of high school.”

Hicks said that giving her children their first cellphone is a sign of their growing independence and maturity that comes along with entering a new chapter of adolescence. It also provides that “electronic” tether to home. Her children know that once they have that cellphone they are expected to call her if they find themselves in a situation in which they aren’t comfortable with what’s going on around them. With a phone in hand, there’s no excuse for not calling mom when they’re at a party without any parental supervision or where other kids might be drinking alcohol or doing drugs.

I mostly agree with Hicks philosophy, and so I think that under 13 years old is a bit young to give a child a cellphone of her own. Again, I know lots of people do it, and I am not passing judgement. I just think that kids today will have a lifetime of gadgets and cellphones (see previous blogs regarding changing technology) and it won’t hurt them to wait another few years before getting one of their own.

Instead, I’d recommend using an old phone or a cheap feature phone as a “family” phone that can be kept on the family cell phone plan for $10 a month and loaned out to any child in the family on an as needed basis.

For example, you could give your 11 year old daughter the “family” phone if she is going to the movies or a middle school dance, so she can call you when she needs a ride home. But I think it’s probably unnecessary for her to have her own phone to text message her friends. While I don’t think that all text messaging between tweens is bad, it’s an interaction that you as a parent are not able to monitor in real time. I think the biggest proponents for allowing kids cellphones is to ease our fears for our kids when they are alone. I feel that this alleviates that by giving them that “security” but not allowing them to have the full features of a smartphone.

So, what is the appropriate age for a cellphone? That’s my recommendation under 13. But what about older kids? When is it appropriate to get your kid a phone, and when should you consider getting your child a smartphone?

Life was much easier for parents a few years ago when cellphones did one thing, made phone calls. But now with smartphones, kids can get full access to the Internet on their phones. While this can be a great thing, especially for adults, when you’re searching for a nearby restaurant or need directions to your doctor’s office, as a parent, it adds another element of risk for your children who now have access to all kinds of inappropriate content in their pockets.

If you feel comfortable allowing your child to have open access to the Internet and to social networking sites, such as Facebook and Twitter, on your home computer, then you can consider allowing a smartphone. Again, I would suggest that this kind of access is not appropriate for elementary or middle school children, but more for an older teenager, who is more mature.

It’s hard to put an exact age on this, but I’d say that if you follow my philosophy a pre-paid type phone would be appropriate as a first cellphone for when a child first enters high school. And a smartphone might be more appropriate for a junior or senior in high school. Again, I think you need to consider the maturity of your child when deciding at what age to allow a smartphone. Now…also take into consideration that it is my opinion that this child should be held partially responsible for paying for the phone and/or the monthly fees that go along with it. This not only teaches the responsibility of having a phone of their own, but just as important it teaches them the importance of financial responsibility.

If you take my advice, be careful when you’re shopping for a phone for your child. To complicate matters further, the distinction between regular feature phones and smartphones is quickly fading. And wireless operators are making it more difficult to find bare-bones phones for wireless subscribers. Instead, they are trying to steer customers, whether they are adults or children, into devices that use more data services, which means more access to the Internet and social networking services like Facebook and Twitter.

Not only does it provide access to services and content you may not want your kids accessing, it also costs more money. So beware.

If you can’t find the most basic, no-frills cellphone that doesn’t offer any access to the Internet while you’re shopping for a phone, you can still consider a pre-paid phone that can be purchased at most major retailers like Walmart and Target. But if you don’t want to enable access to the Internet, make sure you check out the parental control options through the carrier you are using to shut off access to the Internet. The bigger nationwide carriers all offer some parental controls, but check out their websites for specifics or ask the salesperson for more information.

These “quick messaging” devices featured on many carrier Websites can be a good choice if you’re willing to use the parental controls for several reasons. First, they serve as a perfect gateway between a regular feature phone and a smartphone. With parental controls, you can limit access to services like data, as well as limit when they can access the phone and which numbers they can call. But as your child matures, you can allow more access through the control Website. So your son or daughter can get more functionality as he or she matures.

The second reason these phones are great is that they are inexpensive to buy and own. Often you can get one for free or for less than $50 with a two-year contract. And if you restrict the data service, you don’t need to subscribe to an additional data plan.

These devices also appeal to kids because they come in cool colors, and most of them have full QWERTY keypads or touch screens, which are great for text messaging and accessing social networking sites.

Some good examples of these phones are the Verizon Wireless’s Samsung Intensity II, which Verizon markets it as “one intensely social phone.” It has a slide-out QWERTY keyboard for quick messaging and it has Facebook and Twitter integrated into the device for fast access to those services. It also can work with Verizon’s V CAST Music with Rhapsody service, which costs extra. (This service can also be restricted through the parental control settings.)

Verizon also has the LG Cosmos 2, which is free with a two-year contract. It has QWERTY keyboard and 1.3MP camera and also offers access to Facebook and Twitter.

AT&T also has a lot of these “quick messaging” devices, such as the Samsung Solstice II, which has a QWERTY keyboard and a touch screen. It comes free with a two-year contract from AT&T. Or another QWERTY phone, the Samsung Evergreen.

Verizon and AT&T have several phones in this category and they frequently change their special offers, so check on the Website or at a retail store for the best deals.

Controlling what your child can and cannot access on a smartphone gets a little trickier. Apple has a pretty good set of parental controls for iOS devices, which includes the iPhone. So you could restrict the downloading of certain apps or you could turn off the Safari Internet browser altogether. But you’ll still be paying for the data plan. And while voice minutes can be shared in a family plan, data usage cannot. So when you add smartphones to a family plan or you add data to a “quick messaging” feature phone, every line requires its own data plan. And these charges can really add up.

What’s more, new smartphone subscribers on AT&T and Verizon Wireless, the two largest wireless providers, cannot get unlimited data service. So there is a risk that your child could run over the usage cap, especially if you’re an AT&T subscriber and plan on getting the 200MB plan for $15 a month. (Most users, even kids, should be fine with the AT&T 2G service for $25 a month or Verizon’s 2GB plan which costs $30 a month.)

If cost is your primary concern, then prepaid services might be a better option for some families. You can get basic feature phones for calling and texting, as well as inexpensive smartphone plans. Services, such as Virgin Mobile and MetroPCS offer full fledged Google Android smartphones for $100 or less. And you can get a plan for as little as $35 a month from Virgin Mobile. The service includes unlimited texting and data with 300 minutes of talk time. MetroPCS offers unlimited voice, texting and data for $40 a month.

With prepaid services, you won’t have to worry about your teenager exceeding the talk, texting or data usage limits, since they can’t exceed their monthly limit. But the downside is that you won’t have the ability to control the service and usage as much through parental control settings as you would through a bigger carrier. Hopefully this information helps you if you are the parent of a son or daughter that has been asking for a phone or like me have kids approaching the age where it start becoming a topic of consideration.

http://www.marybethhicks.com/

http://support.verizonwireless.com/video/product/managing_vzw_service/What-is-the-Parental-Controls/index.html

www.att.com

December 12, 2011

Newsflash: anything a cell network can do, the Internet can do better and cheaper

Ok we have seen the ads for Magic Jack Phones (19.99 for the year) and Vonage about cutting the cord with your regular phone company, well now it is time to say goodbye to your cell company.  Republic Wireless is unveiling a super cheap, $19-a-month, no-contract, unlimited-talk, data, and text cell phone plan meant to blow away the mobile market.  Having used both Magic Jack and Vonage I was impressed that a Cell company was going to push the talk over the internet.  Works well for the Land Lines.

 

Republic Wireless is a mobile network startup is based in Cary, N.C., and is owned by Bandwidth.com, a growing telecommunications provider. The company can provide such low rates because it expects most calls to be carried over Wi-Fi networks, in customers’ homes and elsewhere. It requires customers to have access to at least one Wi-Fi network. Calls get carried by Sprint’s cellular network only when a Wi-Fi network isn’t available. According to Republic Wireless, most people are around Wi-Fi networks 60% of the time.

 

Republic wireless is offering The LG Optimus (for $199), running Android 2.3 (Gingerbread) for 19.00 a month.  It is a hybrid of phones and will use the internet while you have an available wireless connection.  For roaming they are buying blocks of time from Sprint.  Looks interesting so I started to look a bit deeper.  They claim it is unlimited but you could consume 550 minutes, send 150 texts, and download 300 megabytes of data without crossing the community’s fair use threshold. Anything over that on Cell Usage you will be reminded of the guidelines and to what extent you’ve crossed the fair use threshold. Republic Wireless will provide you with tips for reducing your cellular footprint and plenty of opportunity to get back on track. When they contact you about your usage, they will let you know how much time you have to correct your problem. But if you look closer at that they are not talking about the usage on the Wireless Internet.

 

I’m ready to give it a try as they have a 30 day guarantee but so many people are jumping to give it a try that I’m on a waiting list.  Maybe by January I will hear something from.  Hope this catches on and that they can make a go of it.  What do you think the other mobile phone vendors are thinking about them?  Are you ready to try it?

 

http://www.republicwireless.com

December 6, 2011

They are convenient, but are they secure?

My family was sitting around the dinner table discussing this and that when the subject of cars came up. My brother is looking into buying a new car and we were talking about all of the new computerized gadgets and gizmos that are in cars these days. My father is adamantly against computerizing cars, preferring to rely on levers and cables as opposed to letting a computer do the work. On the surface this seems like just another case of the last generation not understanding or trusting the technology of the former generation, however as we discussed it someone brought up some very interesting thoughts.

 

Is it possible that the more computerized cars get and the more cars do to “make driving easier” the worse people will actually get at driving? I think there is a line somewhere between making things easy/convenient and enabling people to be lazy/stupid drivers. Things like backup camera’s, proximity alerts, and automatic traction control are great, but what happens when that camera fails, or your traction control doesn’t work properly and you begin to skid? It wouldn’t surprise me at all if within the next couple generations driving will look nothing like it did for us.

 

Another little tidbit we discussed was that this past January Ford released the first ever software update for a car which fixed some bugs and added several features to thier “MyFord Touch”. This means that it is now possible to change the programming of computers in vehicles. Cyber crimes are a huge issue, I mean the FBI has an entire task force dedicated to it, and it is altogether plausible that before to awful long will start to see technology that allows people to hack into and take control of your vehicle through its computer. This could open up entirely new opportunities for theft, homicide, and any number of other possibilities…scary thought no?

 

Now with all that being said I am not personally against computerizing cars, its where technology is and its where it is going but it is an interesting thing to think about, not only just with cars but with all aspects of our lives as we all get more and more plugged into the network that is the technology of our age. As with all things if this does happen they will come up with a way to safeguard against it, and then people will figure out a way to overcome that safeguard and they will come up with another line of security and the cycle will go on. So don’t let this stop you from buying a car with all the bells and whistles, but also don’t forget how to drive without them. It doesn’t matter how advanced the car is if the person behind the wheel is incompetent.

December 5, 2011

Google Chrome Security

Some of the information below can also be applied to other browsers also:

I made a comment about me not trusting Chrome for security reasons.  One of my big concerns is how much of my data can Google see and collect?  It leads me deep into Google’s r Privacy Notice (http://www.google.com/intl/en/privacy/) to see what they have to say.  At the writing of this Chrome’s Section was last modified October 25, 2011 and in viewing the archived versions it appears they up date it about 3 times a year since 2009.

Google does not require personally identifying information to down load the Chrome software or to use it.  When you use Chrome, Google only receives “standard Log Information” which has IP Address and cookie information.  Like most Web sites, Google servers automatically record the page requests made when you visit their sites. These “server logs” typically include your web request, Internet Protocol address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser/computer.

Here is an example of a typical log entry where the search is for “security”, :

###.###.###.### – 28/Nov/2011 10:15:32 -

http://www.google.com/search?q=security -

Firefox 8.0.1; Windows NT 5.1 – 740674ce2123e969

  • ###.###.###.### is the Internet Protocol address assigned to the user by the user’s ISP; depending on the user’s service, a different address may be assigned to the user by their service provider each time they connect to the Internet or it could be the same if you have a static IP address;
  • 28/Nov/2011 10:15:32 is the date and time of the query;
  • http://www.google.com/search?q=security is the requested URL, including the search query;
  • Firefox 8.0.1; Windows NT 5.1 is the browser and operating system being used; and
  • 740674ce2123a969 is the unique cookie ID assigned to this particular computer the first time it visited Google. (Cookies can be deleted by users. If the user has deleted the cookie from the computer since the last time s/he visited Google, then it will be the unique cookie ID assigned to the user the next time s/he visits Google from that particular computer).

Wow that is some information they store and they can start to match up information based on the unique cookie ID and IP Address if users don’t delete the cookies.  So big deal, I’m behind a corporate firewall and there are a hundred computers on that connection but if you look at that information the cookie data will be directly related to MY machine, so they can pin it down to one machine.  Ok so how long will Google keep the data for?  “We (Google) strike a reasonable balance between the competing pressures we face, such as the privacy of our users, the security of our systems and the need for innovation. We believe anonymizing IP addresses after 9 months and cookies in our search engine logs after 18 months strikes the right balance.”  That’s a long time to keep that information.

In addition to the above information if you are using Chrome as a browser some other interesting things happen (this is just a short list of what’s happening)

  • As you’re typing the address the letters that you are typing are sent to your default search engine and if the engines auto complete feature is turned on it will give you recommendations. If you have set Google to be the default they are now tracking your keystrokes.
  • If you type in a bad address that is nonexistent Chrome will send that information to Google to try to suggest the correct site.
  • Chrome includes Google’s Safe Browsing feature and will scan Google’s database for reports of malware or phishing and will let you know if it finds something.  This is over and above any virus / malware scanning you are doing outside the browser.
  • Synchronization feature – will store your bookmarks, history and chrome settings on their servers but you need to setup a Google Account to do this.
  • Location Feature will send local network information to Google to try to get an estimated location of where you are located.  This will look at the IP Address you are connected, signal strength of your connection and some other information.

Things you can do to limit the information sent:

  • Disable Chrome’s Auto complete Feature (Under the wrench Icon, select options, under the hood tab, privacy section, deselect the “Use a prediction service to help complete searches and URLs typed in the address bar” checkbox.)
  • Disable suggestions on Navigation errors (Under the wrench Icon, select options, under the hood tab, privacy section, Deselect the “Use a web service to help resolve navigation errors” checkbox to disable the feature.)
  • Check the other settings that are under the privacy section to see what you think about them.  One of them that comes unchecked by default is “Automatically send usage statistics and crash reports to Google “
  • Disable Synchronization feature – (Under the wrench Icon, select options, personal stuff, sync section has your information)
  • If the box is NOT Checked that item is disabled.

Chrome does send a lot of information but in Today’s world any server we are connecting to or through is keeping logs with as much information as they can collect so I guess I really need to look into what extensions can be run to help me control what information is “leaked” out.

November 29, 2011

Google Chrome Extensions

Here are some extensions you can run to see what is happening behind the scene or to help protect your surfing:

  1. Web of Trust – shows you which websites people trust for safe surfing, shopping and searching on the web  (even has a setting for color blind accessible version). This extension  can access your data on all websites and your tabs and browsing activity
    (https://chrome.google.com/webstore/detail/bhmmomiinigofkjcapegjjndpbikblnp)
  2. Last Pass – is a free password manager and form filler. LastPass is also available for Firefox, Internet Explorer and Safari. All the password data is locally encrypted, so even if the LastPass service is hacked, your passwords are safe. This extension  can access your data on all websites and your tabs and browsing activity
    https://chrome.google.com/webstore/detail/hdokiejnpimakedhajhdlcegeplioahd
  3. Password Fail- Warns you if the website being used stores their passwords in plain text form. This extension can access your data on all websites and your tabs and browsing activity.
    https://chrome.google.com/webstore/detail/ockgeenjbijlgilppfieaklfopnbdpge
  4. Credit Card Nanny - This Chrome extension is just like Password Fail except Credit Card Nanny highlights websites that store or send your credit card number (and other data) as clear text. Credit Card Nanny helps you avoid the online stores that engage in this risky business. This extension  can access your data on all websites and your tabs and browsing activity
    https://chrome.google.com/webstore/detail/lfmmjpapolbaaddobpnlcjkgchmhhoog
  5. Secure Profile – It’s all fine and good not to share your passwords or browsing data with unknown online parties, but what about the people who use your PC? The Secure Profile Chrome extension encrypts and password-protects your Chrome profile data — including all those stored passwords and form auto-completes — so that anyone who gains access to your machine can’t also gain access to your online accounts. This extension can access your tabs and browsing activity.
    https://chrome.google.com/webstore/detail/eddeeogaiodnhfkingpegpmhpdiifbgh
  6. Bug Me Not Lite – Almost every web site seems to want you to create an account — and to track your access history across the Internet — even if you only plan on visiting once. With the BugMeNot Lite Chrome extension, simply click CTRL+i and those login forms will be auto-completed with anonymous information. You get access, but the site gets no data. This extension  can access your data on all websites and your tabs and browsing activity
    https://chrome.google.com/webstore/detail/lackfehpdclhclidcbbfcemcpolgdgnb
  7.  Google Alarm - Perhaps more amusing the useful, the Google Alarm Chrome extension sounds a shrill siren alert anytime you load a page where Google is collecting browsing data (Google Analytics or Google AdSense)  This extension  can access your data on all websites
    http://jamiedubs.com/googlealarm/ 
  8.  KB SSL Enforcer - If certain sites or services offer a Secure Sockets Layer login or access option, the KB SSL Enforcer will automatically select that https:// URL. This extension  can access your data on all websites
    https://chrome.google.com/webstore/detail/flcpelgcagfhfoegekianiofphddckof
  9.  Click & Clean - The Click & Clean Chrome extension is the option for erasing your browsing history. Besides removing all the URLs from your browser logs, Click & Clean also deletes every cookie, web temporary file, local web artifact, LSO and download history item from your browser — whether they could do harm or not. In short, it makes it look like you’ve never browsed the Internet before… This extension can access all data on your computer and the websites you visit.
    https://chrome.google.com/webstore/detail/ghgabhipcejejjmhhchfonmamedcbeod

So lets get out there and see if there are others we can use

November 28, 2011

Google search engine or personal assistant?

We all use Google and know pretty much about the search features but what about some of the other things it can do?  What do you like doing with it?

Let’s do some playing!

1.       www.google.com/pacman you can spend hours playing 1 or 2 person pacman

2.       www.google.com/logos/2011/lespaul.html Play some music on a Les Paul Guitar

3.       www.google.com/logos/2011/henson.html – Play with the Muppets

4.         Go to Google.com, Type Google Gravity, Click on I’m feeling Lucky

5.       you can convert your Google page to have an Elmer Fudd language www.google.com/webhp?hl=xx-elmer

6.       What is the answer to life, the universe and everything?

OK enough playing here are some of the other things  you can use with it.  Presented in no particular order:

1)      Use it to get local time anywhere: To see the time in many cities around the world, type in “time” and the name of the city

2)      Use it as a spell checker: Google’s spell checking software automatically checks whether your search uses the most common spelling of a given word. If it thinks you’re likely to generate better results with an alternative spelling, it will show you the results for the other spelling.

3)      Currency conversion: simply enter the conversion you’d like done into the Google search box

4)      Unit Conversion: convert between many different units of measurement of height, weight, and volume among many others. Just enter your desired conversion into the search box.

5)      Track flight status: To see flight status for arriving and departing U.S. flights, type in the name of the airline and the flight number into the search box.

6)      Use it for the current weather: To see the weather for many U.S. and worldwide cities, type “weather” followed by the city and state, U.S. zip code, or city and country

7)      A Calculator: To use Google’s built-in calculator function, simply enter the calculation you’d like done into the search box

8)      See Public Data: To see trends for population and unemployment rates of U.S. states and counties, type “population” or “unemployment rate” followed by a state or county. You can click through to a page that lets you compare different locations.

9)      Stock Quotes: To see current market data for a given company or fund, type the ticker symbol into the search box

10)   Sunrise or Sunset :  To see the precise times of sunrises and sunsets for many U.S. and worldwide cities, type “sunrise” or “sunset” followed by the city name.

11)   Dictionary: To see a definition for a word or phrase, simply type the word “define” then a space, then the word(s) you want defined. Note that the results will define the entire phrase.

12)   Use it to find local places:  Example you have a craving for a sub but not sure where to go

November 25, 2011

Social Engineering – A Matter of Trust

In the world of cyber security, there is one very dangerous exploit that no anti-virus can ever detect, that no firewall can block, and that no complex password can ever protect a person from.  This one catastrophic flaw in security is enough to bring down large corporations and government agencies in mere seconds.  So what kind of security threat could possibly be that big?  Social Engineering.

Social Engineering is the art of manipulating people – usually through blind trust, habit, or curiosity – to either divulge what is seemingly innocent information or perform a rudimentary task.  Most of the time, people don’t realize they have even fallen victim to a Social Engineering attack until it is too late (assuming they ever find out!).

Most people are familiar with the popular forms of Social Engineering attacks.  For example, an email or phone call from your “bank” asking you to provide information they should already have or the ever-popular Nigerian Prince scam.  Just about any get-rich-quick plan that has been floating around in emails or even the “smilingly-innocent” Facebook games can be boiled down to a form of Social Engineering (Random fact: Did you know that all you need to pull a person’s credit report is their name and address?  Keep that in mind the next time you go to let a Facebook app access your personal information!).

A few days ago, I received a call from a man named “Tom” who works at the company that we will call “XYZ”.  I’ve never worked with Tom directly before this but he knew all of the people whom I’ve worked with and he knew many details about the project our business was doing for company “XYZ.”  The purpose of Tom’s call was to ask about a credit report that our business had processed for company “XYZ.”  Now, one of my job requirements is to help our customers with any problems so my instinct was to immediately help Tom out.  But here’s the problem: How do I know Tom really works for company “XYZ?”  Does Tom even have permission within company “XYZ” to discuss confidential credit information?

As much as I wanted to trust Tom, I couldn’t.  Caller ID’s can be faked and the information he had about the project could have been obtained through questionable means (namely, insecure emails).  As far as I knew, Tom could be trying to using a form of Social Engineering known as pretexting (the practice of getting your personal information under false pretenses ) to squeeze information out of me that could be used against either the individual whose credit report he was asking for, against company “XYZ,” or against our business.

The good news is that I was able to call my contact at company “XYZ” and verify that Tom was indeed in a position to request help from me (more on this later).  However, let’s assume Tom was trying to exploit me and look into areas where he would have been trying to exploit me through:

1)      Helpfulness:  He would have been trying to use my desire to help out a customer to gather confidential data!

2)      Trust: He would have been looking for me to trust that he really did work for company “XYZ” and that he had their best interest in mind.

Notice something?  The very things that make a good employee and support person – or just a nice person in general – can also be that person’s biggest weaknesses!  Let’s look at a few more, simpler cases of Social Engineering:

-          Holding the door:  You’re assuming that the person you are holding the door for is actually allowed in the building.

-          Piggybacking:  Letting someone who “locked themselves out” or “forgot their ID” inside the building.

-          Dumpster Diving:  If you don’t shred documents or destroy hard drives properly, anyone can get your confidential data out of the trash.

-          Curiosity/Learning (AKA Baiting):  “Let’s see what’s on this CD…”, “Let me try this application…”, “I’ll open this document/url…” – All of these are famous last words before unknowingly installing a virus or malware!

-          Diversion:  Persuading a person responsible for a legitimate delivery that the package they are delivering (data or physical) is to be delivered to an alternate location through a last minute decision the company had made.

-          Email: Most people don’t realize that all of their emails bounce from server-to-server in plain text and can be easily snooped.

Notice that all of the above examples do require an element of trust or false sense of security.  So, how do we get around this?  Simple: Don’t blindly trust anyone.  Now this solution sounds easy but how can you do this practically in the real world?

In IT, one of the most reliable forms of security is a process known as Pretty Good Privacy (PGP).  It is a complex security protocol that essentially requires a form of trust in order to allow a recipient to access its encrypted payload.  Prior to exchanging any secure data, the two parties involved will exchange what are known as “keys.”  The purpose of this is so that two key’s are required to “open” (decrypt) any secure file exchanged between the two parties.  Those key’s are:

1)      The sender’s public key (we’ll call the sender “George”):  This is the key that George presents to the individuals who are authorized to decrypt his encrypted data.  This way, since George’s private key was used to “lock” the file, his public key is required to “unlock” it.

2)       The recipient’s private key (we’ll call the recipient “Sam”):  This is the key that only Sam will possess, which will unlock anything that was locked by his public key.

As a result, George knows that Sam is the only one who can unlock the file since Sam is the only one who has the matching private key.  Likewise, Sam knows the file is from George because the file can only be unlocked using George’s public key (and only George has the matching private key required lock the file in the first place).

Why did I mention this?  Because the basic principle behind this security is also the best way to establish trust and therefore minimize the chance of being exploited through Social Engineering.  This is because your trust is based on:

-           Something you have (i.e. George’s public key)

-          Something you know (i.e.  Sam’s private key)

Going back to my case with Tom, before I could help him, I had to be sure he was who he claimed to be.  My processes of authenticating Tom went like this:

1)      Something I know:  I called up my contact at company “XYZ” and verified that Tom worked for them and that he was authorized to look into this case.

2)      Something I have:  I then asked my contact for Tom’s contact information so that *I* could call him.

The last step is just as important as the first one.  Why?  Because even though Tom (the one who worked for company XYZ) passed step one, there is no guarantee that the person I talked to was that Tom.  However, since I was the one calling him, I knew that I was talking to the correct Tom.  Therefore, I was able to address his problem and work with him in confidence.

 

Further reading:  http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars/1  This details how the hacking group Anonymous used simpl attacks and social engineering to take down the entire Federal branch of the computer security company HBGary.

November 23, 2011

My Top Technology of (all) Time

I was thinking back over the years about all the interesting gadgets that have been created, invented, and discovered. Some were gone before the public even new they were created. While some are still around today, in one form or another.

Anyone remember the Atari VCS/2600 which found it’s place in many homes (including mine)  in the the late 1970′s. You can’t underestimate the importance of the original Atari, which made home gaming what it is today. All modern game systems owe some portion of their success to this simple machine. The VCS (later named the 2600) sold 8 million units in 1982. The 2600 eventually sold nearly 40 million units, paving the way for competitors and imitators alike.

How about the Nintendo Game Boy (1989)?

A monochrome screen, four way control pad, and two action buttons used to be all it took to entertain kids for hours! The original Game Boy may look primitive by today’s standards, but consider the state of handheld gaming prior to then. Two words: Mattel Football. Through a whopping nine versions, the Game Boy has gotten progressively smaller, while Nintendo’s hold on the portable gaming market keeps growing larger. More than 188 million Game Boys have been sold throughout the years, making it easily the most influential portable gaming device ever constructed.

Iomega Zip Drive (1994)
Before broadband, and before the ubiquitous writable CD, there was the Zip disk. If you regularly dealt with files larger than a few hundred kilobytes, you invested in a Zip drive, which used a super-floppy disk of sorts to hold 100MB (later 250MB and even 750MB) worth of data. The Zip was fraught with technical problems (the “click of death” being its most infamous), but during the latter half of the nineties, you really had no other choice. (What, you were going to buy a SyQuest cartridge? Please.) Look through your desk drawer, and we wager you’ll find at least one of Iomega’s iconic squares collecting dust.

Nintendo Entertainment System (1985)

You didn’t think I forgot this masterpice, did you? Gaming had been wallowing in a two-year depression when its savior finally arrived. The NES was a powerful gray box that introduced millions to the world of Super Mario Bros., the console’s most visible and lasting hit. With the NES, Nintendo began a years-long reign over home gaming, thanks largely to its near-perfect ports of various arcade classics, like Super Mario Bros. and Donkey Kong. The NES’s legacy is still apparent today in the success of Nintendo’s Wii console, with characters like Mario and The Legend of Zelda’s Link still holding court, some 25 years later.

Apple Airport Base Station (1999)
Apple wasn’t the first company to introduce Wi-Fi, but in 1999 its flying saucer Base Station became a visible (and stylish) emblem for the joys of wireless connectivity. Apple was a forerunner when it came to incorporating 802 b into laptops, and it championed the technology before other vendors did. Nowadays, Apple’s Airport Extreme Base Station is a direct descendant of the earlier technology. But even though the company is a relatively minor player in networking hardware, the original Base Station had a powerful influence in the early days of Wi-Fi and helped kick-start the migration to the wireless world as we know it today.

Netscape Navigator (1994)
Before IE, Chrome, Firefox, and Safari there was Netscape. Netscape was the reason people started spending hours a day on the Internet, leading to the boom (and bust) of many a Web site. The advent of the browser also led to the U.S. Department of Justice’s antitrust suit against Microsoft, after the company embedded Internet Explorer into Windows. And Netscape’s August 9, 1995, IPO is universally considered to be the official start of the dot-com era. Netscape, unfortunately, couldn’t keep up with the times and was surpassed by Internet Explorer in the late nineties. The Netscape browser still exists (under the ownership of AOL), but has fallen into utter disuse. Nevertheless, its influence can still be felt all over the Web. Fragments of its original code, for instance, live on in just about every browser still in production, from Mozilla Firefox to Internet Explorer.

Apple II (1977)
What was so special about the Apple II? It offered plenty of productivity tools (it was the first PC to run the VisiCalc spreadsheet, for instance), it was good at gaming, and it was quite extendable (when is the last time you saw a computer with eight expansion slots?). And the machine itself looked so much cooler than anything that had preceded it, a philosophy that still lives on in the Apple computers of today. The Apple II may not have been the first personal computer, but it was the spark that ignited the personal computing industry. If you’re lucky, you might still be able to find an Apple II on eBay, thought they don’t seem to last long.

Lastly, my personal favorite, TiVo HDR110 (1999)
It’s hard to believe but it’s true–TiVo has been around for almost a decade, making it nearly geriatric in the world of technology. The premise is simple: TiVo replaced the VHS tape with a monster hard drive, recording shows to disk instead of to analog media. That meant you could pause and resume live TV, skip through commercials in an instant, and record an entire season of 24 with just a few clicks of the remote control. TiVo’s innovations helped it to handily beat ReplayTV in the battle for mind share, though it struggled to reach profitability and now risks falling prey to that killer of many a promising company: commodity status. Though TiVo the brand may eventually die, “tivo” the verb will probably be with us forever.

These are some of my top gadgets….tell me some of yours.

Source: http://www.pcworld.com/article/123950-7/the_50_greatest_gadgets_of_the_past_50_years.html

November 21, 2011

Shrink-Wrap Agreements

The next time you order something from a manufacturer, be it a computer or a toaster, take time to read the paper or booklet entitled Terms of Sale or Terms of Agreement that comes with your order. In the past you may have ignored this booklet filled with microscopic mumbo-jumbo (I know I have). But In doing so, you unwittingly entered into a contract.

A shrink-wrap agreement (also called shrink-wrap license) is an agreement between a manufacturer and purchaser/user, which becomes valid when the purchaser opens the box the product is shipped in. Regardless of whether or not the purchaser reads the agreement, by keeping the product they validate the agreement.

For example, say you order a computer part from a manufacturer. When you receive and open the box, you validate the agreement contained in the box. If you keep and use the product, you are legally bound by this shrink-wrap agreement.

If the shrink-wrap agreement states that all sales are final after 15 days instead of the normal 30 days, you cannot return the product if it breaks on the 16th day. If the agreement states that all arbitration will take place in Alaska, you have to travel to Alaska to arbitrate or sue the manufacturer.

In most cases, shrink-wrap agreements cover terms that we generally expect when purchasing products. But when you order an expensive or specialty item, be sure to read the shrink-wrap agreement so you are aware of your legal options should something go wrong.

Older Posts »
Privacy Policy | Terms & Conditions | Related Sites | SpyderMap | Web Portal | Exchange Links | Affiliates