Firewalls Don't Stop Dragons Podcast

Marketing companies have come up with may clever ways to track our travels around the web, hoping to garner as much information about us as they can. At the same time, privacy-conscious organizations have given us tools to maintain our anonymity by countering these tracking technologies. It’s the usual arms race – one that privacy advocates were mostly winning, with VPN’s, blocking third party cookies, and privacy-enhancing browser plugins. But now we’re faced with the nuclear option: browser fingerprinting. Our browsers cough up dozens of detailed bits of information about us: OS type and version, browser type and version, fonts and plugins installed, monitor resolution, and much more. When taken together, this information creates a fingerprint of our system – one that is often very unique. Preventing this sort of fingerprinting is extremely difficult, making most of the above privacy-enhancing techniques useless. I’ll tell you how it works and what you can do to mitigate this. In other news: Facebook sues NSO Group for using WhatsApp to track people; Google buys FitBit (and all its data); Apple’s privacy website is revamped; Microsoft Office is building in much-needed protections against infected files; and researchers figure out how to hack Siri, Alexa and Google Home from afar using lasers.

How are our identities stolen? What happens to our identity information after its been stolen? Once we realize we’ve been hacked, what can we do to mitigate the damage and recover from the consequences? I’ll discuss this and much more with Amyn Gilani from 4iQ – including why you shouldn’t be participating in all those fun social media quizzes. Amyn Gilani leads strategy and product at 4iQ. Previously, he was a Chief Technologist at Booz Allen Hamilton where he provided expertise to federal and commercial clients focusing on incident response, red teaming, threat hunting, and cybersecurity operations engineering. Prior to joining Booz Allen, Amyn was a Vice President in Information Security at Goldman Sachs where he led Red Team Operations and emulated sophisticated attacks against securities trading platforms and payment systems. He began his career serving in the United States Air Force as an intelligence analyst and was on detail at National Security Agency and United States Cyber Command. Further Info: 4iQ: https://4iq.com/ Report identity theft and other resources: https://www.identitytheft.gov/ Defending Digital podcast: https://defendingdigital.com/carey-parker-firewalls-dont-stop-dragons/

I’ve been a Dropbox user for many, many years. But recently, they’ve gotten really pushy – trying to get me to save all my photos and docs there, integrating with MS Office when I didn’t ask it to, and pushing me to upgrade. Now it tells me I need to deactivate all but three devices (I have probably 7-8). I’ve been looking for a secure and (more importantly) private alternative for a while now, and this pushed me to move. Today I’ll compare several cloud sync services and tell you why I picked Sync.com. In other news: Firefox keeps delivering excellent privacy features and gets top ranks in two new reports; NordVPN was “hacked” but you shouldn’t be worried; ISP are lobbying hard to stop DNS over HTTPS in browsers; some clever researchers show how to create legitimate Amazon Echo and Google Home apps that can eavesdrop and phish for passwords; and macOS Catalina arrives with several bugs but also several welcome new security features. Further Info: Sign up for Sync.com (referral gets us both 1GB extra); http://www.sync.com/get-started?_sync_refer=bd7921700 Switch to Firefox: https://www.mozilla.org/en-US/firefox/new/

You’ve got ransomware! Now what? If you had the foresight to create safe backups, you can restore your data and move on. Sometimes the hackers screw up and you can actually recover your files directly without paying for the key. But in many cases, you have no real choice but to pay. Cyber insurance can not only help you cover those costs, but insurers can deal directly with the hackers for you and help you with the restoration process. Joshua Motta is the CEO and Co-founder of Coalition, the fastest-growing provider of cyber insurance for small to medium sized businesses. Having worked at the intersection of the intelligence, finance, and technology sectors at the CIA, Goldman Sachs, and most recently as an early employee and CxO of Cloudflare, he gained valuable insights into the minds of hackers and how — and why — they target specific organizations, as well as how organizations can most effectively manage cyber risk. He founded Coalition to provide a better way to protect small and midsize businesses from breaches and cyber incidents. Further Info: Coalition Cyber Insurer: https://www.thecoalition.com/ Help with ransomware: https://www.nomoreransom.org/en/index.html

As our world becomes increasingly technical and interconnected, we become more susceptible to technical misfortunes and feel more impact when they inevitably occur. In the first half of my interview with Joshua Motta, we’ll talk about the recent rise in ransomware attacks: how people and companies get infected, what we know about the hackers, and why ransomware is such an effective and debilitating attack. Joshua will even explain how ransomware has become a cottage industry unto itself. Joshua Motta is the CEO and Co-founder of Coalition, the fastest-growing provider of cyber insurance for small to medium sized businesses. Having worked at the intersection of the intelligence, finance, and technology sectors at the CIA, Goldman Sachs, and most recently as an early employee and CxO of Cloudflare, he gained valuable insights into the minds of hackers and how — and why — they target specific organizations, as well as how organizations can most effectively manage cyber risk. He founded Coalition to provide a better way to protect small and midsize businesses from breaches and cyber incidents. Further Info: Coalition Cyber Insurer: https://www.thecoalition.com/ Help with ransomware: https://www.nomoreransom.org/en/index.html

What happens to all the files, photos, songs and other data on your devices when you resell them or throw them away? Well, if you don’t do anything, all that data is still there, waiting for someone else to access it. A recent study showed that 60% of used hard drives still had accessible data on them. Today I’ll tell you how to properly wipe the data from your smartphones and computers before you get rid of them. And there were a lot of other news items this week, including severe bugs in both Apple and Android smartphones, Cloudflare’s wonderful new free mobile VPN app called Warp, a bug in WhatsApp that could allow complete takeover of your device, how to pronounce “GIF”, the SIMJacker hack that affects well over a billion phones, and yet around call by the government to “backdoor” our encrypted communications. Further Info: Hope to Wipe Your Data: https://firewallsdontstopdragons.com/wipe-data-before-dumping-devices/ Windows 10 privacy settings: https://spreadprivacy.com/windows-10-privacy-tips/

So what happens when your face print (or any biometric info) is stolen from a server? You can’t change your face like you can change your password. Is there anything you can do to avoid your face being scanned or prevent your face from being recognized? What can you do right now to halt the use of facial recognition technologies while we sort out all the social implications? The answers to these questions and more in the second half of my interview with EPIC’s Jeramie Scott! Jeramie Scott is Senior Counsel at EPIC and Director of the EPIC Domestic Surveillance Project. His work focuses on the privacy issues implicated by domestic surveillance programs with a particular focus on drones, AI, biometrics, and social media monitoring. Mr. Scott regularly litigates open government cases and cases arising under the Administrative Procedure Act. He is also a co-editor of “Privacy in the Modern Age: The Search for Solutions” and the author of “Social Media and Government Surveillance: The Case for Better Privacy Protections of Our Newest Public Space.” Prior to joining EPIC, Mr. Scott graduated from the New York University Law School where he was a clinic intern at the Brennan Center’s Liberty and National Security Program. His work at the Brennan Center focused on civil liberty issues arising from local law enforcement surveillance. Further Info: Electronic Privacy Information Center (EPIC): https://epic.org Privacy in the Modern Age: The Search for Solutions: https://www.amazon.com/Privacy-Modern-Age-Search-Solutions/dp/1620971070 Glenn Greenwald’s TED Talk on Privacy: https://www.ted.com/talks/glenn_greenwald_why_privacy_matters Petition to ban the use of FRT: https://www.banfacialrecognition.com/

Use of facial recognition technology (FRT) is exploding around the globe. While touted as a convenience for checking in for a flight or crossing the border, the opportunities for abuse are staggering. People act differently when they feel they’re being watched. There’s a reason we have sayings like “dance like no one is watching”. But US agencies like TSA and CBP have gained access to treasure troves of faces from DMV and passport databases, without ever asking our permission, and they’re rolling out FRT across the nation. There are no laws or regulations on the use of this technology, and little thought being given to how constant, mass surveillance will affect our democratic and human rights. In the first part of my two-part interview with Jeremie Scott (EPIC), we’ll discuss how we got here. Jeramie Scott is Senior Counsel at EPIC and Director of the EPIC Domestic Surveillance Project. His work focuses on the privacy issues implicated by domestic surveillance programs with a particular focus on drones, AI, biometrics, and social media monitoring. Mr. Scott regularly litigates open government cases and cases arising under the Administrative Procedure Act. He is also a co-editor of “Privacy in the Modern Age: The Search for Solutions” and the author of “Social Media and Government Surveillance: The Case for Better Privacy Protections of Our Newest Public Space.” Prior to joining EPIC, Mr. Scott graduated from the New York University Law School where he was a clinic intern at the Brennan Center’s Liberty and National Security Program. His work at the Brennan Center focused on civil liberty issues arising from local law enforcement surveillance. Further Info: Electronic Privacy Information Center (EPIC): https://epic.org Privacy in the Modern Age: The Search for Solutions: https://www.amazon.com/Privacy-Modern-Age-Search-Solutions/dp/1620971070

No doubt sensing the impending US privacy regulations, Google has released a plan to “enhance” user privacy… by finding different ways to track you. Instead of relying on cookies and fingerprinting, Google proposes that we just come out in the open and formalize tracking technologies. While that could give users more transparency and a modicum of control, the bottom line is that Google is really just trying desperately to save its business model (ads based on tracking). While there are actually some good ideas in their proposal, many of the technologies they’re putting forward could be even worse for your privacy than the current schemes. Today I’ll walk through the EFF’s excellent analysis of these propositions and give my own take. Further Info: EFF: Don’t Play in Google’s Privacy Sandbox: https://www.eff.org/deeplinks/2019/08/dont-play-googles-privacy-sandbox-1 EFF’s Panopticlick tool: https://panopticlick.eff.org/

Today we speak with EFF’s Matthew Guariglia about the creepy new partnership between Amazon’s Ring Doorbell division and local law enforcement. Recent disclosures reveal that Amazon has partnered with over 400 police agencies to market their product and share surveillance footage. While these footage requests can supposedly be refused by the Ring owners, there appear to be circumstances where Amazon will provide footage without consent. The marketing of Ring has changed from convenience to an automated neighborhood watch program, where the police have been coached in how to drum up interest in the product and to assuage fears over sharing their private footage. Matthew Guariglia is a policy analyst for surveillance and privacy at the Electronic Frontier Foundation. He is also a visiting research scholar at the University of California-Berkeley and holds a PhD in U.S. history. His work focuses on the relationship between race, immigration, policing and government surveillance in the past and present. You can find his writing in the Washington Post, VICE, and the Freedom of information-centered outlet MuckRock. To find his writing you can follow him on Twitter at @mguariglia or visit MatthewGuariglia.com. Further Info EFF’s Street Level Surveillance : https://www.eff.org/issues/street-level-surveillance  Protecting Civic Spaces: https://privacyinternational.org/long-read/2852/protecting-civic-spaces