Rubénerd!

Almost two years ago, I bemoaned the fact Yahoo were creating new things, but were still the only major mail provider to not offer SSL. On an unsecured wireless network, this is an open invitation for anyone to hijack your session.

Well, they finally listened!

Activating SSL adds an extra layer of security to your account. While using SSL protection is optional, we recommend it if you are on an unsecured internet connect, such as a wireless network at a cafe.

It's a step in the right direction, but it desperately needs to be enabled by default. As a developer and sysadmin I know most people don't change default settings, which means most of their users will still be unprotected.

If you still use Google services regularly, it's worth noting they allow you do disable some of the tracking they perform. Browser plugins can help to block the rest.

Disable Web History

Most people I talk to don't realise Google records all the sites they visit through their searches. They bill it as a way to "tailor search results". The DuckDuckGo people call it "search bubbling". I deem it "unnecessary". Fortunately, Google lets you turn it off:

1. Log in, the go to history.google.com
2. Click the gear button on the right hand side
3. Choose "Settings"
4. Click "Pause"

To confirm, go back to history.google.com and notice the bright blue "Turn History On" button. Isn't it interesting that Google lets you turn web tracking on with one click, but it takes three clicks and loading a menu behind an untitled button to turn it off? ;)

It should be noted here that web history is merely being "paused". Whether Google can turn it back on, or can be compelled to, would be reason enough to logout when you want to use their search.

Adorable Hyouka detective image by こよる on Pixiv

Set DoubleClick tracking opt-out cookies

Google's advertising arms and subsidiaries track you across sites by default, but you can disable it with a cookie by visiting:

https://www.google.com/ads/preferences/html/opt-out.html

Google now even offer a plugin for Firefox, Chrome and Internet Explorer to store your desire not to be tracked. I haven't tested this, so I can't vouch for it.

https://www.google.com/ads/preferences/plugin/

In both cases, these opt-outs are stored in your browser, not your account. Therefore, to prevent this kind of tracking you need to have the opt-out cookie and/or plugin installed on every browser and on each computer/smartphone. Cumbersome, I know, but it's currently the only option Google allows us.

Browser extensions

To further prevent tracking, there are several different plugins you can use.

For Mozilla browsers, Gprivacy forces sites to respect the do-not-track header by sanitising links in search results. Any links that it modifies in your browser are shown with a green shield, and the original link with a red shield is included alongside it.

If you're not interested in maintaining a cookie whitelist with CS Lite Mod or Cookie Monster, the Beef Taco extension maintains opt-outs for hundreds of advertising networks, including Google. I've blogged about this before.

Done

As I've said with all cloud computing services, the key isn't to abstain from them, but to use them wisely. As Professor Frink would say, MMMMMMMM-HIVEN MAVEN!

This is good news, right?

Image of Detective Oreki and Chitanda by 紫木れゆ on Pixiv

It didn't used to be this way, Smithers

I've pointed out here before that Chrome didn't include Do Not Track, the HTML header that establishes a user's wish not to be tracked. I said it was unsurprising given Google is an advertising company, but it was still disappointing given how many people are using their browser.

(As an aside, the most common retort I read is that DNT won't block all tracking, so it's useless. If it was so useless, why was Google afraid of including it then?)

It wasn't all bad news though. When Apple, Mozilla, Opera and Microsoft were actively working towards a standard and implementing DNT in their browsers, Chrome users could install a plugin to do the job. I suppose, in the same way a user could install an ad blocker to hide Google's primary source of revenue. Again, you can empathise with Google's position.

To put this into context though

If you're worried about tracking, I'd question using a browser being pushed by an advertising company. Still, to Google's credit they've finally announced they're including Do Not Track header support in Chrome. I applaud them for this. Sincerely.

For some perspective however, Google's DoubleClick still requires users to store an opt-out cookie on their machine to prevent tracking. Plugins like Beef Taco can assist in keeping these persistent, or you can simply whitelist cookies only from sites and services you trust. Not logging into Google anymore has really helped with keeping their cookies off my machines!

There have been so many password "hacking" stories lately, I thought I'd write this post so I can refer back to it. For added security, I've included the above image of Makise Kurisu, the scientist in my anime harem.

Covering my behind

Crypto is an exact science, so before I go any further I will make these clear.

• When I say random, technically I mean pseudorandom. Algorithms are deterministic, and computer order and logic can't strictly speaking produce "true" randomness. Contemporary algorithms are an order of magnitude better than the BASIC RND() function of yore though.

• When I say impossible and one way, I mean practically speaking. Our current algorithms would take the birth and death of several universes to brute force with current hardware, but that doesn't mean it's impossible. Just very very very very improbable!

How passwords are supposed to be stored

When you create an account with a well designed, secure website, your chosen password is not stored anywhere. Instead, your password is put through a one way cryptographic hashing algorithm which converts it to random gibberish, along with some salt or random information only the web server knows.

When you attempt to log into your site, the password you give is hashed and compared to the hash on file. If they're the same the server knows you have the right password.

It's a proven, tested technique and it works... provided everything is implemented properly. No doubt you've seen plenty of news stories suggesting sound security is harder than coming up with some snappy alliteration on a blog post.

Why go to the trouble?

Rather than storing a hash of a password, you could simply store the password and compare it when someone logs in. It's simpler, and a worryingly large number sites still do this.

The problem is, if the database is broken into, the malicious hacker has access to all your customer's passwords. People like conserving energy (politically correct way of saying lazy!), and are probably using those same passwords for all sorts of stuff including their banking sites, email, social networks and so on. You can see what a disaster this could be!

If you store them as hashes, all anyone ever sees is random gibberish... even the site owner!

How to tell

Short of asking the site administrator, there are two main tells that a site is storing your passwords instead of a hash:

• They're able to provide you with your password. This could happen when you first create your account and they send you a welcome email, or if you've said you've forgotten your password. A secure site should always direct you to a page to reset it, because they don't know your password either.

• Hashes take any password length and adjust them to a uniform size (such as 128 bits). Not always, but often if a site puts a limit on your password length, it's because they're storing it as plaintext in their database.

There may have been (bad) excuses for these practices in the past, but not any more. If a site you access does either of these, it's time to question how important they are and whether they're worth risking your data and security over. Blunt, but true.

If you suspect a site you access is storing your password in plain text and you have no choice but to use them, complain, and make sure you pick something random and unique to that one site. If/when they get broken into, you'll be glad you did.

In the future
Everybody will be famous anonymous
For 15 minutes

In 2011 I discussed how I was giving Google the benefit of the doubt regarding their harvesting of open WiFi data, and that it was consumer network hardware manufacturers that should be working to protect consumers. I was... at least partly wrong!

Uh-oh

From my Google's non-existent whitelists... exist post I wrote on the 11th of March 2011:

Take the street view controversy. While I think Google engineers were short sighted by not closely studying the source code of the software they put on their trucks and drove around the world, I don't believe they did it maliciously.

Unfortunately, we now know that isn't true. From Stilgherrian:

So, you know when Google’s Street View cars, the ones taking photos down every street, were also accidentally scooping up people’s unencrypted Wi-Fi traffic? Turns out the engineer who wrote the software did it deliberately, and his boss knew he did.

The European Union isn't impressed, and may reopen their case against Google. To quote John Gruber:

Uh-oh.

But the networks were open!

Back when this controversy started and people were blaming Google for stealing people's data, I read an equal number of posts from other bloggers blaming people for having open wireless networks in the first place. I acknowledged this:

These signals were being broadcast in the open, and while the scale of Google's downloading may warrant further scrutiny, it skips the real issue that people are still broadcasting unencrypted data out of their homes for anyone to gain access to.

Still, I didn't go as far as to blame consumers.

Rather than blaming consumers (which is always an easy thing to do) however, I place the blame on network hardware manufacturers for selling devices that didn't make this clearer.

Unfortunately, we now know in hardware manufacturers attempted to make security easier for consumers by implementing WPA2 standards, and in the process introduced a security vulnerability so severe it bypasses the otherwise strong encryption used by them. All of course except Apple, and I remember people chewing me out for having a Airport Extreme base station... heh ;D.

Regardless, there are a lot of issues at play here, not least the ethics of some Google engineers. Any company can/does have rogue players, but the key is transparency. Only disclosing this now rubs me the wrong way, a little.

Why comment on the name when there's already a prefabricated meme? ;)

Editional Redundancy

Having bought myself a large cup of caffeinated beverage at my local café without even specifying what I wanted (I've always wanted to be a "regular" somewhere!) I dug into Microsoft's news about the upcoming release of Windows 8.

According to the Window Steam blog, which I can only assume discusses how best to clean panes of glass, Microsoft will be releasing Windows 8 in three versions; a regular, a premium and one specifically for ARM tablets dubbed Windows RT.

Two quick asides about the hardware. First, isn't it a fascinating historical twist that an Apple spinoff eventually became so successful Microsoft had to break their Wintel model and release a version of Windows for it? Windows on different architectures isn't new; Windows/386 was specifically targeted at that CPU and Windows NT Workstation was offered on the DEC Alpha and PowerPC, but it shows even the once invincible Microsoft wants to hedge their bets in this emerging market.

Secondly, you've got to think Intel are keeping an eye on this trend!

Back to the Editions

Microsoft have been very successful in convincing people that having editions of their operating system is a great idea, though fortunately they're only releasing Windows 8 in three versions. It's still too many, but it's a start. See what I did there?

Why is it still too many? One word: encryption. With the need to artificially differentiate products in order to charge people differing sums of money, certain features have to be removed from the final product in order to entice people to upgrade; again a practise plenty of people are willing to defend for some reason.

While Microsoft seem to have been fairly consistent with only including enterprise and more advanced features in their higher end Windows versions, some features that really should be part of the base product have also been removed at times. Not being able to change desktop wallpapers in Windows 7 Starter, for example. You can't make this stuff up.

Unfortunately, the feature they've decided to leave out of the standard version of Windows 8 is far more critical than whether or not you can put a cute anime girl as your desktop background.

Encrypting File System

Okay, I used this entire post as an excuse to show Madobe Nanami again. Honestly, of all the reasons I've had given to me to move back onto Windows, this adorable Windows 7 mascot is the most convincing one so far. True story.

Anyway, when I saw the lack of an "X" under their "Encrypting File System" for the standard version of Windows 8, I was lucky I didn't regurgitate the mouthful of otherwise fantastic coffee I was sipping on. I wanted to reach through the screen, pull out a Microsoft engineer and ask them why not!

Certainly it's not a technical limitation, as far as I can tell. Mac OS X has it, most Linux distributions have it, even Google's ChromeOS (remember that?) has it. The pro version of Windows 8 has it.

Putting people's privacy and data at risk for the sake of product differentiation seems reckless to me. I hope — nay, implore — Microsoft to reconsider.

Tin foil hat!

That is... unless they're leaving it out for other reasons. Perhaps the prospect of default whole drive encryption on virtually every new computer around the world was scary enough a prospect for law enforcement that they leaned on Microsoft to not include it on the most popular version. Heck, the rhetoric in the US has long been about how difficult encryption is making certain investigative jobs.

Of course I have no proof of this, but the speculation is irresistible!

I've touched on the whole New Google thing a few times, but only in reference to other people's comments. Here are some of my own. Get it? TRACKING!? :D

Inevitability

In the same way Microsoft and Lotus standardised the disparate applications that made up their office suites, on the surface Google is attempting to simplify things for their users and engineers by making things look and work similar. Leaving aside questions of effectiveness, one need only look at the user interface changes in Gmail, Google Reader, Analytics and Google+ to see this new line of thinking in action.

In that vein, a unified Terms of Service for all their products makes nothing but sense. Instead of a different one for each service, their users can now ignore and click accept under just one.

Still, while everyone seems worried with the tracking (more on that below), I'm more concerned that a unified Terms of Service will lead to the same lowest common denominator problem that is plaguing their new UIs. Some services naturally need more and different information than others, but a blanket TOS would (logically, perhaps?) need to include all of these. The result is services that don't need certain personal information to operate now have legal access (well, as legal as a TOS can be, as I sort of wrote about way back in 2006).

It didn't entirely wash with me, and it seems even US lawmakers are having a hard time believing it too.

Tracking

The tech world is all a dither about the potential tracking problems this new TOS introduces. For one thing, all their services will now be sharing data with each other, and worse still you won't be able to opt-out of this sharing. The end of the world... right?

Firstly, anyone who banked on having their YouTube history insulated from their Google profiles, Gmail history and so on need a cold glass of reality. I've been told they've always been doing this, so presumably they've merely become public about it recently. In either case, wake up guys!

Secondly, not being able to opt-out is also not unusual behavior from Google. While other advertising companies were issuing statements saying they'd respect the Do Not Track headers that Mozilla, Apple and even Microsoft had implemented into their browsers, Google was tellingly silent. Under increasing public pressure, they eventually released an optional extension for Chrome. If you want some fun, try opting out of DoubleClick's tracking as well. On every browser on every device you own. Individually.

I'm not entirely defending Google here, I'm just pointing out they're doing what they've always done. They're an internet advertising company.

Conclusions

As I've repeatedly said here, it's impossible to have complete privacy online, and cloud computing will only continue to grow. The key isn't to stop using the Internet, it's to use it intelligently. There's still a place for Google (indeed, any cloud company), provided you take the right precautions and weigh up the utility you derive from them with what you're giving up.

Sandra Laville, crime correspondent for The Guardian:

The Metropolitan police said emails were sent out to 1,136 victims, mostly of car theft or pickpockets, as part of a survey on 30 January. But the addresses were put in the wrong section of the email, which meant they were shared with other victims.

While New Google and Facebook are taking the headlines, I'd still argue the biggest threat to online privacy still comes from people misusing IT (and from Sherlock). Part of the solution is education and effective oversight, but even then we're all prone to making mistakes, and our software isn't perfect.

Perhaps the Metropolitan Police should look into using email clients with stricter field validation!

Eager to capitalise on the concerns we share regarding Google's decision to "officially" drop Do No Evil, Frank X. Shaw from Microsoft has responded with a posting on the TechNet blog. Seriously!

I had an MSDN subscription in high school

During the last week or so, there has been a fair amount of discussion about how Google is making some unpopular changes to some of its most popular products. You can see some of the concerns and worries about lack of choice and so on in these links.

I no longer link to Gawker or Murdoch publications on principle; but otherwise that was the introduction. You have my attention Mr Shaw!

When we read the coverage last week, it was clear people were honestly wrestling with the choices that had been made for them and were looking for options or alternatives.

This is definitely true. I can only speak from my elitist circle of snobby tech nerds on Twitter and newsgroups, but the number of threads and tweets concerning Google alternatives has been exploding of late. There's even evidence average folk are paying a little more attention; I've overheard several conversations in coffee shops and trains saying their "tech friends" or "smart people" have told them to look elsewhere.

But enough about my thoughts, lets wrap up Mr Shaw's comments.

The changes Google announced make it harder, not easier, for people to stay in control of their own information.

That's it in a nutshell. Mmm, nuts.

Now for our alternatives

From then on, Mr Shaw goes on about how we should be using Hotmail, Bing, Office 365 and Internet Explorer, and how Microsoft wants "to give [us] control over [our] data". A little ironic given they were once the poster child for vendor lock-in, and that Office still has sketchy support for their own ISO standards. It also doesn't help that I can't try IE because I'm not on Windows on my production machines ;).

Still, under the IE subheading Shaw points out something:

The world’s most popular browser, now with Tracking Protection, offering controls over your privacy as you browse.

Previously their "implementation" of tracking protection seemed needlessly different given the world had standardised on DNT headers, but according to Microsoft they've included this starting with IE9. I would still advice people not to use it, but nice to know those who have no choice have this feature.

And to help remind people of these alternatives, we’re placing a series of ads in some major newspapers this week.

Them fighting words. I expect there's going to be a heated debate in Google PR over this, in which case I find myself thanking Microsoft. It hasn't been the first time lately; I praised their progressive stance on same sex marriage, and gave kudus to the Windows Phone team for developing their own UI rather than just robotically copying the iPhone, if you will.

Hell is freezing over, I tell you! Well, kinda.