Archive for the ‘ privacy ’ Category

FreedomBox project.

I like this. I particularly like the idea of this being able to form a mesh. In my opinion it will be the mesh network that we will eventually rely on for the free dissemination of information. There are many other projects out there that can be aggregated to form the mesh. I mentioned the mesh-potato in the past. There are also many consumer grade wireless routers that can be adapted to the mesh task with freely available custom firmware. I use the WRT54GL and Tomato at home now. Its brilliant.

Here are some other mesh network related sites:

SSH usage, multiple private keys.

There is no doubt that SSH stands as one of the greatest system administration tools ever. I use it many times a day manually and many more through scripts for sysadmin stuff. Sometimes, like today I needed to do something that I have never needed to do before. And of course SSH is capable.

Due to a new network topology at the office I needed to be able to have SSH source more that one private key for authenticating to a remote host. There is more that one way to do this. I used the first solution as it was the most basic.

In the ~/.ssh folder create a file named “config” and chmod it to 600. Add the following line: “IdentityFile ~/.ssh/id_rsa.keyA” and add a subsequent line for the other private keys you want to use. For example you can have “id_rsa.keyA” “id_rsa.keyB” and so on. Make sure that those references actually match the names of your private keyfiles, if not, rename them. Thats it. From now on, when you attempt an ssh key exchange, all those keys will be sourced.

The second solution is more refined. This is what your ~/.ssh/config file might look like for this method.
Host *.home
IdentityFile ~/.ssh/id_rsa.home
Host *.office
IdentityFile ~/.ssh/id_rsa.office
Host *.wan
IdentityFile ~/.ssh/id_rsa.wan

In this case the host you are connecting to will determine the key that will be presented rather than presenting all keys like the first example.

Thanks to Karanbir Singh and his post for helping me with this.

More privacy related thoughts.

Our governments abuse of its power is nothing new and it will not end. It is in the nature of any large governing bureaucracy be it corporate, civil or federal. Clearly the frenetic pace which technology has advanced over the last couple of decades has afforded the government an opportunity to take advantage of a gap in the public’s understanding of the true nature of these technologies and the potential consequences of their use. Because I’m a bit if a geek it’s clear to me on a daily basis how little people understand about the technology they use and depend on on a daily basis. It may not be so important to understand the workings of your refrigerator but when it comes to the way you share and communicate all aspects of your life you really need to understand whats going on. Most of us are voluntarily contributing to a massive information store that is the result of such daily activities as using cell phones, texting, internet phone calling, emailing, credit cards, grocery store discount cards, movie rentals, online purchases, ATM withdrawals, DMV auto inspections, EZ-Pass toll payments, airline/train travel and more. Some of these situations seem benign, however all of them result in some amount of data being collected, transmitted and stored on a computer in a database somewhere. Do you know who knows every item you purchased at Shop Rite for the last 5 years you’ve been using your membership savings card there? Did you even know that someone has that information? Perhaps you don’t care, after all its only a grocery list. But take all the databases for all the activities I mentioned and start putting them together and your life story is suddenly patent knowledge. What you read, what you eat, how much gas you put in your car and where you go, how much cash you tend to have in your purse and the people you talk to most on weekly basis, how much money you owe and how much you drink, what kind if driver you are and how long you have owned your home. Such is the way we exist to lesser or greater degrees but we do live is a digital world and digits are very cheap to store and very valuable depending on the end user. Life with these amenities is quite nice. It affords many conveniences and efficiencies. The problem is that we trade our privacy for convenience and often without the understanding that we are doing so. When was the last time you agreed to a terms of service by clicking that “I Agree” button? Did you actually read the entire “Terms of Service” document? Never. Try it sometime, you will be shocked at what you are agreeing to. The truth is, in most cases, we don’t control or even own any of this information and we have expressly given away all rights to it forever.

In this recent article by the EFF there are some examples of how privacy can be violated by the government and your service providers. The article focuses on abuses but what strikes me most is that much of the abuse is facilitated by what I hope is the general misunderstanding of the tech we use every day rather than a blatant disregard for our own privacy as a citizenry.

This portion of the report referenced in the article caught my eye and highlighted my concern.

In over half of all NSL violations reviewed by EFF, the private entity receiving the NSL either provided more information than requested or turned over information without receiving a valid legal justification from the FBI. Companies were all too willing to comply with the FBI’s requests, and — in many cases — the Bureau readily incorporated the over-produced information into its investigatory databases. For example, in a violation reported in 2006, the FBI requested email header information for two email addresses used by a U.S. person. In response, the email service provider returned two CDs containing the full content of all emails in the accounts. The FBI eventually (and properly) sequestered the CDs, notified the email provider of the overproduction, and re-issued an NSL for the originally requested header information; but, in response to the second NSL, the email provider again provided the FBI with the full content of all emails in the accounts.

The failure in the bureaucratic process outlined in this example here is completely preventable, not by a more lawfully compliant FBI or a more adept service provider but a more informed and better equipped citizen. Like Uncle Ben told Peter, “with great power comes great responsibility”, the information age is our superpower. Let’s not destroy ourselves with it.

Cloudburst

I’ve never felt comfortable about the so-called cloud and the concept of it being the new home to all of my data. For anyone who questions authority or has any interest in privacy the cloud is extremely questionable but when it comes to data security and stability it is even more so. I can’t see any scenario at this time that is better than having physical possession and total control over your own data.

I think Cringely states a great case HERE.

Airport security?

I saw this article today about a pilot refusing the ridiculous screening imposed on travelers at airports and I really hope this starts some kind of revolt by passengers. Of course we all want to be safe as possible when we fly but the truth is the TSA is not providing safety. The TSA is a (from the article)

make-work program

and

“I just kind of had to ask myself ‘Where do I stand?’ I’m just not comfortable being physically manhandled by a federal security agent every time I go to work,

If you have flown recently you know what a hassle it is and if you have any sort of imagination you can come up with a number of ways to bring banned and even destructive items through security without an issue. The TSA is a charade. Have you noticed the people in charge there? They are clearly not the upper end of the IQ range. I had an agent find a multi-tool in my bag once, he said he had to confiscate the scissors from the kit and when he handed it back to me he left me with the knife blade. How many time recently have you heard of airport terminals being entirely shut down for complete passenger re-screening? This is not done because security is taken seriously, it is because it doesn’t work.

Encryption is looking more relevant.

I have posted about our privacy rights before so this wont be protracted. But this NYT article by Charlie Savage really got me going. The thing that most frustrates me is that these reports of and these threats of the loss of our privacies are so material to our disregard for our rights.

On a technical note, the article speaks to law enforcements desire to have access at certain points along certain provider based services. This is an area where those providers may and in many cases likely will continue to bow to government pressure and relinquish that access to police powers. However we, as the users, the people, have our own tools we can use to maintain our privacy. If by chance you feel you have nothing to hide, fine. Exercise you rights anyway, lest you forfeit them by neglect.