Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Sex, Lies & Instant Messenger v3
1. sex, lies, & instant-messenger
@alecmuffett
www.alecmuffett.com
green lane security
www.greenlanesecurity.com
v3.0
@alecmuffett sex, lies and instant messenger
2. What should come of this?
@alecmuffett sex, lies and instant messenger
3. When using the Web
for private communication...
@alecmuffett sex, lies and instant messenger
4. be aware
1) what can go wrong unexpectedly?
@alecmuffett sex, lies and instant messenger
5. be aware
2) what risks you protecting against?
@alecmuffett sex, lies and instant messenger
6. be aware
3) what must you do/not do?
@alecmuffett sex, lies and instant messenger
7. Goal
“Keep control of your data.”
@alecmuffett sex, lies and instant messenger
8. disclaimer (1)
Almost all examples appearing in this work
are fictitious. Any resemblance to real
events or to real persons, living or dead,
is probably coincidental.
@alecmuffett sex, lies and instant messenger
9. disclaimer (2)
Advice given here is necessarily
incomplete; information security is a huge
discipline and a full set of risks cannot be
conveyed in 30 minutes.
@alecmuffett sex, lies and instant messenger
10. 1) what can go wrong unexpectedly?
@alecmuffett sex, lies and instant messenger
28. password
a window into your mind?
@alecmuffett sex, lies and instant messenger
29. password
reveals something about you?
@alecmuffett sex, lies and instant messenger
30. password
reflects your tastes?
@alecmuffett sex, lies and instant messenger
31. password
is known to your spouse?
@alecmuffett sex, lies and instant messenger
32. also
• reuse = self-incrimination
• ...which is bad...
• ...more later...
@alecmuffett sex, lies and instant messenger
33. basic password discipline
• use a password management tool
• use 12/more random characters
• use different passwords at each website
• never reuse passwords
• never share passwords
• change annually/more often
• change when someone discovers one!
@alecmuffett sex, lies and instant messenger
35. do not Skype IM with your lover!
@alecmuffett sex, lies and instant messenger
36. Skype
• peer to peer architecture
• robust, replicated, flexible
• excellent security
• ...unless you’re up against the USA
• ...or China
• ...or maybe the UK
@alecmuffett sex, lies and instant messenger
37. virtually impossible to expunge
a recent conversation
@alecmuffett sex, lies and instant messenger
38. deletion can make things worse
messages resurrect from the dead!
@alecmuffett sex, lies and instant messenger
39. (zombie data is not good)
@alecmuffett sex, lies and instant messenger
40. Avoid XMPP with a lover...
• Also called Jabber Protocol
• Implementations:
• GoogleChat
• Some Facebook chat
• Other systems
@alecmuffett sex, lies and instant messenger
41. XMPP
• Initial message is multicast
• sent to all logged-in instances
• eg: “hello sexy”
• ...also arrives on the home PC
• ...whilst you are at work
@alecmuffett sex, lies and instant messenger
42. Other IM systems?
• Not really wise...
• AIM now multicast
• YIM likewise
• Go for something simple
• Avoid specialist IM-client software
• Use web-based systems
@alecmuffett sex, lies and instant messenger
49. D bob Nude! http://twitpic.com/b0gu5
@alecmuffett sex, lies and instant messenger
50. Twitter App Risks
• Third-party apps get access to DMs
• Twitter clients...
• Web Apps...
• Proliferation of data is unwise
• more backups
• more caches
• more access
@alecmuffett sex, lies and instant messenger
51. do not Facebook your lover!
@alecmuffett sex, lies and instant messenger
52. too easy to get wrong
@alecmuffett sex, lies and instant messenger
53. Dropping Hints
homepage displays with whom you
communicate frequently
@alecmuffett sex, lies and instant messenger
54. “Transitive trust”
friends-of-friends may not be friends
@alecmuffett sex, lies and instant messenger
55. Tommy Jordan!
YouTube Video:
Facebook Parenting: For the troubled teen
@alecmuffett sex, lies and instant messenger
56. Facebook Software Ecology
Facebook is not really Facebook
@alecmuffett sex, lies and instant messenger
57. Analogy
if you want to be private,
don’t throw your diary
into a pub full of gossips and journalists
@alecmuffett sex, lies and instant messenger
68. held to lower standard than IM
@alecmuffett sex, lies and instant messenger
69. heavily-integrated software
• game
• webcam
• voice
• third party stuff
• Ventrillo
• Mumble
• ...
@alecmuffett sex, lies and instant messenger
70. game logs
• logfiles are...
• comprehensive
• disparate
• spattered all over the hard drive
• ...and therefore hard to remove
@alecmuffett sex, lies and instant messenger
73. avoid sharing geolocation
• Foursquare, Twitter, etc
• “...but your Twitter messages said
that you were in Essex?”
@alecmuffett sex, lies and instant messenger
74. Do you have an in-car GPS?
...and do you know how to wipe it?
@alecmuffett sex, lies and instant messenger
75. next, an obvious thing that’s often missed:
@alecmuffett sex, lies and instant messenger
76. do not send porny naked pictures
of yourselves, to each other
@alecmuffett sex, lies and instant messenger
81. homebrew porn
• Took it with iPhone?
• backed up to iTunes
• backed up to iCloud?
@alecmuffett sex, lies and instant messenger
82. homebrew porn
• boyfriend’s archive copies
• ...for sharing when you break up
@alecmuffett sex, lies and instant messenger
83. do not use the family computer
@alecmuffett sex, lies and instant messenger
84. there’s a reason it’s called
a family computer
@alecmuffett sex, lies and instant messenger
85. do not use work-related hardware
@alecmuffett sex, lies and instant messenger
86. work hardware
• not your machine
• thus: “not your data”
• may be taken from you
• eg: bankruptcy, fired, updated
• old hardware auctioned
• automated backups?
• network access logged?
@alecmuffett sex, lies and instant messenger
93. Things Geeks Do
• Enumerate all possible URLs:
• tinyurl
• bit.ly
• is.gd
• t.co
• ...and save the good ones
@alecmuffett sex, lies and instant messenger
94. Things Geeks Do
• Trawl...
• Picasa
• Twitpic
• Yfrog
• ...to much the same ends
@alecmuffett sex, lies and instant messenger
95. Things Geeks Do
• buy hardware from Ebay
• undelete data files
• desktops
• laptops
• printers (!)
• storage
• hard disks
• thumb drives
• SD cards
@alecmuffett sex, lies and instant messenger
96. Things Geeks Do
• buy phones from Ebay
• restore deleted SMS
• retrieve e-mail passwords
@alecmuffett sex, lies and instant messenger
97. Find hardware in the street...
@alecmuffett sex, lies and instant messenger
100. Your challenge is to make that hard
@alecmuffett sex, lies and instant messenger
101. 3) what must you do/not do?
@alecmuffett sex, lies and instant messenger
102. do use separate identities,
do not link identities!
@alecmuffett sex, lies and instant messenger
103. create a disposable identity,
start with an e-mail address
@alecmuffett sex, lies and instant messenger
104. use a fake, boring,
common pseudonym
• good
• edward wilson
• carole smith
• bad
• sexxxy4UinBasingstoke
• anything else that’s unique
@alecmuffett sex, lies and instant messenger
105. is this legal?
• probably breaking terms of service
• is it criminal to lie?
• maybe...
@alecmuffett sex, lies and instant messenger
106. idea:
Use a disposable Gmail account
to set up a fake Yahoo account
or vice-versa.
@alecmuffett sex, lies and instant messenger
107. do not bookmark your secret identity
@alecmuffett sex, lies and instant messenger
108. do use a random password
• never used before
• never use anywhere else
• keep the password in your brain
@alecmuffett sex, lies and instant messenger
109. do not store the secret identity password
in your normal password manager!
@alecmuffett sex, lies and instant messenger
110. do minimise data proliferation,
do not leave footprints!
@alecmuffett sex, lies and instant messenger
111. do not access your secret identity
from your normal phone
@alecmuffett sex, lies and instant messenger
112. iPhone
• All backed up by iTunes:
• SMS
• call logs
• geolocation (see recent press)
• ...possibly password protected
• You’re using a different password, yes?
@alecmuffett sex, lies and instant messenger
113. Android
• basically ditto
• ...but backed up on Google instead
@alecmuffett sex, lies and instant messenger
114. Do not access your secret identity
using your normal laptop “login”
@alecmuffett sex, lies and instant messenger
115. avoid intermingled filestore
put no pseudonym files
amongst personal files
@alecmuffett sex, lies and instant messenger
116. set up different “users”
• keep sensitive files in one place
• ...hopefully
• ...mostly
• ...except for logs
@alecmuffett sex, lies and instant messenger
117. set up encrypted hard disks
resistant to post-Ebay forensics;
do this prior to any usage
@alecmuffett sex, lies and instant messenger
118. use browsers which support
private browsing modes, and
which delete cookies/history on exit
@alecmuffett sex, lies and instant messenger
124. browser settings (1)
• clear cookies on exit
• clear history on exit
• don't accept 3rd-party cookies
• block popups
@alecmuffett sex, lies and instant messenger
125. browser settings (2)
• don't save form input
• don't save history
• switch off autosuggest
• set to private browser mode
• ...permanently, if possible
• else auto/delete cookies on exit
@alecmuffett sex, lies and instant messenger
126. plugins / similar
• Flash Player
• Visit the security settings panel
• purge Flash cookies and sites
• set Flash db size to zero
• HTML5 settings
• set HTML5 db size to zero
• watch for other/new issues
@alecmuffett sex, lies and instant messenger
127. Firefox extensions
• Tor
• better: Tor Browser Bundle
•SSL Everywhere
•NoScript
•RequestPolicy
•AdBlock Plus
•Ghostery
@alecmuffett sex, lies and instant messenger
128. Adium / Pidgin for IM
• use OTR encryption
• not the same as OTR in GoogleChat!
• solves the point-to-point chat issue
• beware local logfiles
@alecmuffett sex, lies and instant messenger
134. do not leave voicemails
@alecmuffett sex, lies and instant messenger
135. wipe your SMS messages regularly
@alecmuffett sex, lies and instant messenger
136. dumbphone SMS
• lowest common denominator
• messages still logged on backend
• but overall exposure is less
@alecmuffett sex, lies and instant messenger
137. if you must use smartphone
• do not link this phone to your usual
Google Account
@alecmuffett sex, lies and instant messenger
138. if you must use smartphone
• check out:
• WhatsApp
• TigerText
• ...other SMS replacements
• take time to understand how they work
@alecmuffett sex, lies and instant messenger
140. decommission old hardware
• computers
• DBAN - Darik’s Boot & Nuke
• Free suicide pill / CDROM for PCs
• phones
• Remove SIM
• SMS may be on SIM as well as phone!
• Check whether factory reset actually works
• if not, smash it & drive a car over it repeatedly
@alecmuffett sex, lies and instant messenger
141. bottom lines
• the more copies of data exist
• the harder it is to remove them
• when data escapes your control
• it's available forever
@alecmuffett sex, lies and instant messenger
142. when mistakes happen...
• clean up calmly
• do not amplify the mistake
@alecmuffett sex, lies and instant messenger
143. remember
• your lover has the same data
• but may not be taking care of it
• educate them gently
• his/her systems will also
one day be sold on eBay
@alecmuffett sex, lies and instant messenger
144. So why must you actually know all this?
@alecmuffett sex, lies and instant messenger
