privacy page 3 - Dave's Blog

Search
My timeline on Mastodon

Google: If You Commit a Felony, Don't Google It or You'll Go to Jail

2009 Jan 20, 11:40"But, when police searched his computer, they found Google searches from a couple days after the accident like, "auto parts, auto dealers out-of-state; auto glass, Las Vegas; auto glass reporting requirements to law enforcement, auto theft," according to the prosecutor. The coup de grace? He searched for "hit-and-run," which he followed to a page about the hit-and-run he committed."PermalinkCommentsprivacy google internet crime

philosecurity - Blog Archive - Interview with an Adware Author

2009 Jan 13, 6:20"So we've progressed now from having just a Registry key entry, to having an executable, to having a randomly-named executable, to having an executable which is shuffled around a little bit on each machine, to one that's encrypted - really more just obfuscated - to an executable that doesn't even run as an executable. It runs merely as a series of threads."PermalinkCommentssecurity privacy adware malware advertising ie browser scheme interview bho via:li

A rare peek at Homeland Security's files on travelers - This Just In - Budget Travel

2009 Jan 12, 12:48Results of a FOIA request for the DHS travel records: "I had been curious about what's in my travel dossier, so I made a Freedom of Information Act (FOIA) request for a copy. I'm posting here a few sample pages of what officials sent me."PermalinkCommentsfoia security airplane airport privacy government information

For a Washington Job, Be Prepared to Tell All - NYTimes.com

2008 Nov 18, 1:10"...Just in case the previous 62 questions do not ferret out any potential controversy, the 63rd is all-encompassing: 'Please provide any other information, including information about other members of your family, that could suggest a conflict of interest or be a possible source of embarrassment to you, your family, or the president-elect.' ... For those who clear all the hurdles, the reward could be the job they wanted. But first there will be more forms, for security and ethics clearances from the Federal Bureau of Investigation and the Office of Government Ethics."PermalinkCommentsgovernment obama fbi privacy

Yellow Dots of Mystery: Is Your Printer Spying on You?

2008 Oct 23, 11:27Informative and humorous video on the topic of printer tracking dots. "Most color laser printers and color copiers are designed to print invisible tracking codes across every single printed page of their output. These codes reveal which machine produced a document and, in some cases, when the document was printed or copied."PermalinkCommentshumor video security privacy eff printer

obstcp - Google Code

2008 Oct 14, 11:14Similar in concept to the Pirate Bay suggestion of encrypting all TCP/IP connections if both server and client support it: "Obfuscated TCP is a transport layer protocol that adds opportunistic encryption. It's designed to hamper and detect large-scale wiretapping and corruption of TCP traffic on the Internet."PermalinkCommentsinternet tcp encryption security google privacy opensource cryptography network ssl

de-Tor-iorate Anonymity, DefCon, (Nathan Evans and Christian Grothoff)

2008 Sep 22, 1:21Nathan Evans and Christian Grothoff, de-Tor-iorate Anonymity. The presentation notes for a DefCon talk about an attack on Tor in which the attacker may discover Tor nodes used in a session.PermalinkCommentstor anonymity privacy security network defcon

Sarah Palin's Hacked Yahoo Email Account Timeline

2008 Sep 18, 10:05Sarah Palin's Yahoo email addresses were hacked. I agree with the commenter: "I was just about to post how I feel bad for her despite disagreeing with most of her politics. There are plenty of legitimate reasons to attack her (or any politician), but this is clearly personal, not politics. From what I've read, this wasn't even the account she used for those communications she wanted to hide from subpoena, so the vigilante justice angle is BS. This is just plain mean." Although the last sentence of the following made me laugh: "A good samaritan in the /b/ thread reset the password account with the intention of handing it over to Palin, a process known on /b/ as "white knighting". This locked everyone else out of the account. The "white knight" posted a screenshot to /b/ of his pending message to one of Palin's contacts about how to recover the account, but made the critical mistake of not blanking out the new password he set."PermalinkCommentssecurity politics hack privacy government legal email yahoo

The Quantified Self

2008 Sep 16, 4:56All about self-trackers who track and graph all sorts of personal data. I suppose mycrocosm is like the self-tracker's twitter. "A quick overview of the emerging culture of self-tracking ran in the Washington Post the other day. Called "Bytes of Life: For Every Move, Mood and Bodily Function, There's a Web Site to Help You Keep Track." The subtitle is a gross exaggeration, although in time it will be true."PermalinkCommentsprivacy data social personal kevin-kelly

IE8 Beta2 Shipped

2008 Aug 27, 11:36

Internet Explorer 8 Beta 2 is now available! Some of the new features from this release that I really enjoy are Tab Grouping, the new address-bar, and InPrivate Subscriptions.

Tab Grouping groups tabs that are opened from the same page. For example, on a Google search results page if you open the first two links the two new tabs will be grouped with the Google search results page. If you close one of the tabs in that group focus goes to another tab in that group. Its small, but I really enjoy this feature and without knowing exactly what I wanted while using IE7 and FF2 I knew I wanted something like this. Plus the colors for the tab groups are pretty!

The new address bar and search box makes life much easier by searching through my browsing history for whatever I'm typing in. Other things are searched besides history but since I ignore favorites and use Delicious I mostly care about history. At any rate its one of the things that makes it impossible for me to go machines running IE7.

InPrivate Subscriptions allows you to subscribe to a feed of URLs from which IE should not download content. This is intended for avoiding sites that track you across websites and could sell or share your personal information, but this feature could be used for anything where the goal is to avoid a set of URLs. For example, phishing, malware sites, ad blocking, etc. etc. I think there's some interesting uses for this feature that we have yet to see.

Anyway, we're another release closer to the final IE8 and I can relax a little more.

PermalinkCommentsmicrosoft browser technical ie8 ie

Facebook Profile Views Application - Failed Idea

2008 Aug 21, 11:24

I had an idea for a Facebook app the other day. I wondered who actually looked at my profile and thought I could create a Facebook app that would record this information and display it. When I talked to Vishu though he said that this wasn't something that Facebook would be too happy with. Indeed the Platform Policy explicitly disallows this in section 2.8. This explained why the app didn't already exist. Its probably for the best since everyone assumes they can anonymously view Facebook profiles and would be irritated if that weren't the case.

On the topic of assumed anonymity, check out this article on the aggregation and selling off of your cell phone data including your physical location.

PermalinkCommentstechnical facebook privacy cellphone extension

Reporters sans frontieres - Beijing Games 2008

2008 Jul 30, 10:45"Reporters Without Borders therefore offers the following practical advice to foreign journalists to help them cover the human rights situation in China." Install Tor, use PGP and other interesting things.PermalinkCommentscensorship china internet privacy olympics journalism

BBC NEWS | UK | Payout for false Facebook profile

2008 Jul 24, 7:26Fake Facebook page considered libel and gets target big pounds: "Mathew Firsht was awarded 22,000 pounds in damages against an old school friend". Careful what you post...PermalinkCommentsfacebook identity law legal privacy libel

Secure Beneath The Watchful Eyes on Flickr - Photo Sharing!

2008 Jul 24, 12:59I love this poster but I can't believe it was really displayed by the London Metro. Amazing. Reads: "Secure Beneath the Watchful Eyes, CCTV & Metropolitan Police on buses are just two ways we're making your journey more secure."PermalinkCommentsposter propaganda london england cctv art bus photo flickr privacy security

Pirate Bay wants total network encryption, but does anyone else?

2008 Jul 10, 4:44More on IPETEE w/ some of the politics and commentary. "The Pirate Bay has ambitious plans to bring end-to-end encryption to all network activity..."PermalinkCommentsarticle encryption privacy security ip cryptography

Technical Proposal (IPETEE) - TFR Wiki

2008 Jul 10, 4:43"The goal is to implement IP-transport encryption in a way that is transparent both to the IP-layer (including nodes in the network path) and to the applications that benefit from the encryption." Seems like a good idea to me.PermalinkCommentscryptography encryption internet privacy security ip wiki

Compressed web phone calls are easy to bug - tech - 12 June 2008 - New Scientist Tech

2008 Jun 19, 1:00"The new compression technique, called variable bitrate compression produces different size packets of data for different sounds...VoIP streams are encrypted to prevent eavesdropping. However, a team ... has shown that simply measuring the size of packetsPermalinkCommentssecurity privacy phone compression encryption blog article

The Pros and Cons of LifeLock

2008 Jun 18, 12:44Bruce Schneier writes about LifeLock for which you've probably seen the comercials of the CEO parading around his SSN. I was wondering what LifeLock actually did.PermalinkCommentsbruce-schneier identity fraud credit article wired security privacy lifelock

Catalog | Stickers | Sticker #213: Orwell was Right | Microcosm Publishing

2008 Jun 9, 11:34Sticker depicting two CC camers with the text 'Orwell was Right' under.PermalinkCommentssticker orwell purchase shirt product camera privacy

URI Fragment Info Roundup

2008 Apr 21, 11:53

['Neverending story' by Alexandre Duret-Lutz. A framed photo of books with the droste effect applied. Licensed under creative commons.]Information about URI Fragments, the portion of URIs that follow the '#' at the end and that are used to navigate within a document, is scattered throughout various documents which I usually have to hunt down. Instead I'll link to them all here.

Definitions. Fragments are defined in the URI RFC which states that they're used to identify a secondary resource that is related to the primary resource identified by the URI as a subset of the primary, a view of the primary, or some other resource described by the primary. The interpretation of a fragment is based on the mime type of the primary resource. Tim Berners-Lee notes that determining fragment meaning from mime type is a problem because a single URI may contain a single fragment, however over HTTP a single URI can result in the same logical resource represented in different mime types. So there's one fragment but multiple mime types and so multiple interpretations of the one fragment. The URI RFC says that if an author has a single resource available in multiple mime types then the author must ensure that the various representations of a single resource must all resolve fragments to the same logical secondary resource. Depending on which mime types you're dealing with this is either not easy or not possible.

HTTP. In HTTP when URIs are used, the fragment is not included. The General Syntax section of the HTTP standard says it uses the definitions of 'URI-reference' (which includes the fragment), 'absoluteURI', and 'relativeURI' (which don't include the fragment) from the URI RFC. However, the 'URI-reference' term doesn't actually appear in the BNF for the protocol. Accordingly the headers like 'Request-URI', 'Content-Location', 'Location', and 'Referer' which include URIs are defined with 'absoluteURI' or 'relativeURI' and don't include the fragment. This is in keeping with the original fragment definition which says that the fragment is used as a view of the original resource and consequently only needed for resolution on the client. Additionally, the URI RFC explicitly notes that not including the fragment is a privacy feature such that page authors won't be able to stop clients from viewing whatever fragments the client chooses. This seems like an odd claim given that if the author wanted to selectively restrict access to portions of documents there are other options for them like breaking out the parts of a single resource to which the author wishes to restrict access into separate resources.

HTML. In HTML, the HTML mime type RFC defines HTML's fragment use which consists of fragments referring to elements with a corresponding 'id' attribute or one of a particular set of elements with a corresponding 'name' attribute. The HTML spec discusses fragment use additionally noting that the names and ids must be unique in the document and that they must consist of only US-ASCII characters. The ID and NAME attributes are further restricted in section 6 to only consist of alphanumerics, the hyphen, period, colon, and underscore. This is a subset of the characters allowed in the URI fragment so no encoding is discussed since technically its not needed. However, practically speaking, browsers like FireFox and Internet Explorer allow for names and ids containing characters outside of the defined set including characters that must be percent-encoded to appear in a URI fragment. The interpretation of percent-encoded characters in fragments for HTML documents is not consistent across browsers (or in some cases within the same browser) especially for the percent-encoded percent.

Text. Text/plain recently got a fragment definition that allows fragments to refer to particular lines or characters within a text document. The scheme no longer includes regular expressions, which disappointed me at first, but in retrospect is probably good idea for increasing the adoption of this fragment scheme and for avoiding the potential for ubiquitous DoS via regex. One of the authors also notes this on his blog. I look forward to the day when this scheme is widely implemented.

XML. XML has the XPointer framework to define its fragment structure as noted by the XML mime type definition. XPointer consists of a general scheme that contains subschemes that identify a subset of an XML document. Its too bad such a thing wasn't adopted for URI fragments in general to solve the problem of a single resource with multiple mime type representations. I wrote more about XPointer when I worked on hacking XPointer into IE.

SVG and MPEG. Through the Media Fragments Working Group I found a couple more fragment scheme definitions. SVG's fragment scheme is defined in the SVG documentation and looks similar to XML's. MPEG has one defined but I could only find it as an ISO document "Text of ISO/IEC FCD 21000-17 MPEG-12 FID" and not as an RFC which is a little disturbing.

AJAX. AJAX websites have used fragments as an escape hatch for two issues that I've seen. The first is getting a unique URL for versions of a page that are produced on the client by script. The fragment may be changed by script without forcing the page to reload. This goes outside the rules of the standards by using HTML fragments in a fashion not called out by the HTML spec. but it does seem to be inline with the spirit of the fragment in that it is a subview of the original resource and interpretted client side. The other hack-ier use of the fragment in AJAX is for cross domain communication. The basic idea is that different frames or windows may not communicate in normal fashions if they have different domains but they can view each other's URLs and accordingly can change their own fragments in order to send a message out to those who know where to look. IMO this is not inline with the spirit of the fragment but is rather a cool hack.

PermalinkCommentsxml text ajax technical url boring uri fragment rfc
Older EntriesNewer Entries Creative Commons License Some rights reserved.