Brilliant response to when your site gets hacked

Keeping emails and security under control

Do you receive tons of notification emails form your various subscriptions or social sites like Twitter and Facebook and the others? Have you thought about the impact on your productivity all these teasers are?

Well, you might have forgotten (or are you too busy to figure out) how to manage or shutdown the notifications. Check out this handy toy that I just came across: Notification Control.

And in a related story, here's a similar site if you want to review your security and permissions settings on all these sites. Another chore often put off to our own detriment! My Permissions.

Yeah there's really very little to these two sites but I think you might find them very useful!

TSA: Smokescreening

An interesting and fun to read article in Vanity Fair about the security check procedures established by the TSA:

"Taking off your shoes is next to useless. "It's like saying, Last time the terrorists wore red shirts, so now we’re going to ban red shirts," Schneier says. "If the T.S.A. focuses on shoes, terrorists will put their explosives elsewhere. €œFocusing on specific threats like shoe bombs or snow-globe bombs simply induces the bad guys to do something else. You end up spending a lot on the screening and you haven'€™t reduced the total threat." (from: Vanity Fair)

Schneier of course is Bruce Schneier who is always interesting to read. He writes about security and computers. I have quoted him many times before on this blog.

Swipely, cool but scary?

So there's this rather cool new service that says they will find and give you special deals to the stores and merchants you use already. The way they do it is to examine your credit card bills and help you find deals. They say:

With Swipely, you can earn automatic cash back rewards at the best local places Boston has to offer. There are no coupons to cut, vouchers to buy or loyalty cards to forget - with Swipely you earn valuable rewards on every purchase with the credit or debit cards you already have, automatically. Best of all, Swipely is free!

Sounds great, but you know how they do it? You have to give them your credit card info and login to the credit card company web site, so they can look at your charges. They say it is very secure:

Swipely downloads transactions to give you rewards via our banking technology partner using a secure, read-only connection trusted by more than 5,000 banks and 26 million consumers. Swipely uses 256-bit SSL EV bank-grade encryption and SAS 70 Type II secure data centers.

I am pretty promiscuous when it comes to this kind of thing (for example, I've been using Mint.com for a while now) but still this one creeps me out just a little bit. What do you say?

BillGuard

This site looks really good, but I am not signing up yet.

I am famously promiscuous signing up with new services just so I can 'know what's going on', but when the first thing I have to do is to give this site my account and password for a credit card that I use, I stop and take a breath.

Who are these guys? Fred Wilson, a highly reputable VC blogger is the one who recommended it in his blog. Maybe he's an investor? I don't know. But for now, I am holding off.

Wikileaks

Like many, I don't know yet whether I support or condemn the Wikileaks action that has been discussed and debated at length on all fora. You have to agree that it has yielded some interesting insights about the way the world works.

First of all: as far as a diplomat making snide comments about one world leader or another, big deal! I mean it's embarrassing (like someone hacking your email account or finding your personal diary) but certainly no one is surprised -- gossiping and show boating is human nature, yes?

A friend of mine who has been in the foreign service for a long time read the cables with gusto and said if nothing else, it shows that the US foreign service officials are smart and thoughtful and do an impressive and important job.

From that perspective he feels pride that the work that he's done in obscurity for years finally gets seen by his friends and colleagues who can now appreciate it for what it is.

Here are some more serious questions that occur to me:

• If it is illegal for Wikileaks to publish cables that they received (from essentially a whistleblower in the Defense department) then why is it not equally illegal for the New York Times to publish them? Is it because the NYT is 'more reasonable' and will more likely do what the government wants them to do?


• Think about having a thumb drive with 500,000 documents on it. What do you do with it? What's the point of making it available, even to someone with a 'need to know'? How do you make sense of it. Talk about trying to find a needle in a haystack. Chances are good that you won't. It brings up the importance of tools and systems to process, classify, summarize and in general make sense of it.


• This leak appears to have been the work of a lone whistleblower. How is it even possible that a single person has access to such a huge collection of documents? Given the size of thumb drives (I just bought a 16Gig drive for under $30) keeping them from moving in and out of secure buildings is impossible. So the problem is access to the data, and ability to 'export it' at all.

Some final links if you are still with me. Look at this very interesting summary article in the New York Times, which comments on one of the questions I raise above:

"Mr. Packer is very much against the prosecution of WikiLeaks on grounds of treason because, he said, “discerning the legal difference between what WikiLeaks did and what news organizations do is difficult and would set a terrible precedent." (from The New York Times)

Look at this interesting post by David Weinberger, commenting on a fantastic article by Jeremy Wagstaff, who says:

"No, the problem that WikiLeaks unearths is that the most powerful nation on earth doesn’t seem to have any better way of working with all this information than anyone else. Each cable has some header material—who it’s intended for, who it’s by, and when it was written. Then there’s a line called TAGS, which, in true U.S. bureaucratic style doesn’t actually mean tags but “Traffic Analysis by Geography and Subject”—astate department system to organize and manage the cables. Many are two letter country or regional tags—US, AF, PK etc—while others are four letter subject tags—from AADP for Automated Data Processing to PREL for external political relations, or SMIG for immigration related terms." (from Jeremy Wagstaff: Data, Wikileaks and War")

You see, this Wikileaks question raises some important and tricky questions, and they are not all about who called who by what name.

Amazing Stuxnet story

With apologies for quoting a Foxnews story, and with thanks to Scott Adams for the link, here's a fascinating behind the scenes story of Stuxnet:

"The mission: Infiltrate the highly advanced, securely guarded enemy headquarters where scientists in the clutches of an evil master are secretly building a weapon that can destroy the world. Then render that weapon harmless and escape undetected." (from Mystery Surrounds Cyber Missile That Crippled Iran's Nuclear Weapons Ambitions)

and how well did it work?

"“We brought it into our lab to study it and even with precautions it spread everywhere at incredible speed,” Byres said." (from Mystery Surrounds Cyber Missile That Crippled Iran's Nuclear Weapons Ambitions)

Read the whole thing, it's fascinating! Mystery Surrounds Cyber Missile That Crippled Iran's Nuclear Weapons Ambitions

Facebook security

I was experimenting with a little known feature in Facebook, "Download Your Information" which will actually supposedly give you a copy of everything that is 'yours' on Facebook.

The definition of what is 'yours' is fairly tricky of course: is what you posted on someone else's wall 'yours' or 'theirs'? And so on.

But what interested me was how they made double and triple sure that in fact it was me who was downloading my information.

I had to supply my own password again: ok that makes sense.

But then for extra extra security I was shown a bunch of wall photos of people who are my 'friends' and asked to identify them from a multiple choice set of friends. This is harder than you think: not every friend is such a good friend. And not all the wall photos are recognizable. They might be childhood photos, or out of focus group shots at a party or whatever.

But really quite a smart way to make sure that the downloaded content does not fall into the wrong hands.

The Tor Anonymizer

Have you heard of this thing, the Tor Anonymizer? Ok again admittedly another highly geeky system, but pretty fascinating. Makes you think that the handwringing worrying of the security wonks isn't as over the top as all that.

Tor is a sophisticated privacy tool designed to prevent tracking of where a web user surfs on the internet and with whom a user communicates. It's endorsed by the Electronic Frontier Foundation and other civil liberties groups as a method for whistleblowers and human-rights workers to communicate with journalists, among other uses. (from Rogue Nodes Turn Tor Anonymizer Into Eavesdropper's Paradise

Read the article, it's a fascinating look into the world of security.

Location Proofs

The more businesses reward me for showing up at their establishments, the more likely it will be that a bad guy would want to pretend that they were there to garner those rewards.

I came across a very interesting paper that proposes the notion of 'location proofs.':  Enabling new mobile applications with location proofs)

From the paper: "Location is rapidly becoming the next “killer application” as location-enabled mobile handheld devices proliferate. One class of applications that has yet-to-emerge are those in which users have an incentive to lie about their location. These applications cannot rely solely on the users’ devices to discover and transmit location information because users have an incentive to cheat. Instead, such applications require their users to prove their locations. Unfortu- nately, today’s mobile users lack a mechanism to prove their cur- rent or past locations. Consequently, these applications have yet to take off despite their potential." (from Enabling new mobile applications with location proofs)

I think something like this is inevitable, but it will have be invisible because it's too geeky..